linux/poky.git/meta/recipes-devtools, branch yocto-3.0.3

qemu/slirp: fix CVE-2020-7211

2020-05-07T16:32:09+00:00

fix CVE-2020-7211 for qemu slirp submodule see : https://www.openwall.com/lists/oss-security/2020/01/17/2 https://gitlab.freedesktop.org/slirp/libslirp/commit/14ec36e107a8c9af7d0a80c3571fe39b291ff1d4 (From OE-Core rev: 31362d739834377ac4ab880029c3e3dda0cd7698) (From OE-Core rev: c68323151b9bafb5f52dda6a4bd11712feff2e83) Signed-off-by: Chee Yang Lee Signed-off-by: Richard Purdie Signed-off-by: Adrian Bunk Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

qemu: fix CVE-2020-7039

2020-05-07T16:32:09+00:00

(From OE-Core rev: 5ea3d9d83ed695827634e3216664c13fcff6d48a) (From OE-Core rev: b7b96bd938cf4167b4abeebb68d35ba74ce0d3c6) Signed-off-by: Changqing Li Signed-off-by: Richard Purdie Signed-off-by: Adrian Bunk Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

python: Upgrade 2.7.17 -> 2.17.18

2020-05-07T16:32:09+00:00

LICENSE checksum changed due to 2019 -> 2020 update. (From OE-Core rev: b15db3ce3af3460b7f9ae1e186e453a79a056511) Signed-off-by: Adrian Bunk Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

qemu: Add PACKAGECONFIG for glusterfs

2020-05-07T16:32:09+00:00

(From OE-Core rev: b249fddf46b1e1ebeedf3c599acdadd93e6d046a) Signed-off-by: Haiqing Bai Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

git: Security Advisory - git - CVE-2020-11008

2020-05-07T16:32:09+00:00

Backport the 1st -- 9th patches listed by to solve CVE-2020-11008. Also backport the 2nd -- 4th patches listed by for CVE-2020-5260 (not necessary, and only the 1st patch is necessary for this CVE), because some of the above 9 patches are based on them. (From OE-Core rev: 63c7f76912f097cdfb95296778c42887b7336925) Signed-off-by: Li Zhou Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

git: Security Advisory - git - CVE-2020-5260

2020-05-07T16:32:09+00:00

Backport patch from to solve CVE-2020-5260. (From OE-Core rev: e4c3adbaae41147f921dde638b25911d1f5422e1) Signed-off-by: Li Zhou Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

apt-native: don't let dpkg overwrite files by default

2020-05-07T16:32:09+00:00

With --force-overwrite (implied by --force-all), dpkg will not abort when a package overwrites files from different packages. As this can also lead to "The following package disappeared from your system as all files have been overwritten by other packages: " and subsequently broken dependencies, this makes the simple case of conflicting files hard to debug. Instead of finding all possibly required force options, only disable overwrite for now. (From OE-Core rev: b57b311cfaabbcd08ce51760abcd64cf23e1435b) Signed-off-by: Jan Luebbe Signed-off-by: Richard Purdie Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

qemu: Replace stime() API with clock_settime

2020-05-07T16:32:08+00:00

(From OE-Core rev: e69b89575e5ccec243658e09936908dd9e5d45ef) Signed-off-by: Khem Raj Signed-off-by: Richard Purdie Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

python3-native: Should not search the system for headers/libraries.

2020-05-07T16:32:08+00:00

The specific issue here is rpc/rpc.h, but its likely more general. /usr/include is searched for rpc/rpc.h and if it exists on the system, it changes behavior. If you are using the extended buildtools tarball on a machine that has /usr/include/rpc/rpc.h, it will decide that is good enough and not continue to search. nis fails to build because /usr/include and /usr/lib are not part of the include/link paths for the buildtools tarball compiler(nor should they be). This makes it so python3-native will not build if you are using the extended buildtools tarball, but from a larger issue perspective it is building in likely different ways depending on what machine it is building on. libtirpc is already a depend so we shouldn't need the hosts rpc/rcp.h. (From OE-Core rev: f37dfc7907ae7bac08d40468ddde2e5b8bba030c) (From OE-Core rev: db8bef336849570dd99900b173c44cc47b208058) Signed-off-by: Jeremy A. Puhlman Signed-off-by: Richard Purdie (cherry picked from commit 400743867de587579dee85388c30190f353f80c8) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

pseudo: Ensure we use our own libsqlite

2020-04-29T15:11:56+00:00

pseudo-native is special in that bitbake ends up executing it from the sysroot-components directory before we have any workdirs for the bitbake fakeroot worker. Since we switched to dynamically linking sqlite, it means sqlite from the host system may be found, we really want the version in sysroot-components. Trying to run tasks to create some special environment for pseudo is hard and error prone. The simplest fix is to add an RPATH to the binary so that it can correctly find the sqlite we want. Unfortunately passing $ORIGIN into make doesn't work so well with shell quoting so we have to fix that during do_install. [YOCTO #13814] (From OE-Core rev: 2cbb3a663a3d3b2dcf8c12c26843d6087789ded0) Signed-off-by: Richard Purdie (cherry picked from commit 3937ca9e2dfabb1ce9bce1d536b60b1e2a43739b) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie