linux/poky.git/meta/recipes-extended/bash, branch daisy

bash: Fix-for-CVE-2014-6278

2014-10-10T17:06:09+00:00

This vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277 See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6278 (From OE-Core rev: de596b5f31e837dcd2ce991245eb5548f12d72ae) Signed-off-by: Catalin Popeanga Signed-off-by: Richard Purdie

bash: Fix for CVE-2014-6277

2014-10-10T17:06:09+00:00

Follow up bash43-026 to parse properly function definitions in the values of environment variables, to not allow remote attackers to execute arbitrary code or to cause a denial of service. See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6277 (From OE-Core rev: 85961bcf81650992259cebb0ef1f1c6cdef3fefa) Signed-off-by: Catalin Popeanga Signed-off-by: Richard Purdie

bash: Fix for CVE-2014-7186 and CVE-2014-7187

2014-10-10T17:06:08+00:00

This is a followup patch to incomplete CVE-2014-6271 fix code execution via specially-crafted environment https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187 (From OE-Core rev: 153d1125659df9e5c09e35a58bd51be184cb13c1) Signed-off-by: Sona Sarmadi Signed-off-by: Richard Purdie

bash: Fix for exported function namespace change

2014-10-10T17:06:08+00:00

This is a followup patch to incomplete CVE-2014-6271 fix code execution via specially-crafted environment This patch changes the encoding bash uses for exported functions to avoid clashes with shell variables and to avoid depending only on an environment variable's contents to determine whether or not to interpret it as a shell function. (From OE-Core rev: 6c51cc96d03df26d1c10867633e7a10dfbec7c45) Signed-off-by: Sona Sarmadi Signed-off-by: Richard Purdie

bash: Fix CVE-2014-7169

2014-09-29T11:16:38+00:00

This is a followup patch to incomplete CVE-2014-6271 fix code execution via specially-crafted environment Change-Id: Ibb0a587ee6e09b8174e92d005356e822ad40d4ed (From OE-Core rev: e358d20e8ccf1299e8a046e743a31e92546cd239) Signed-off-by: Khem Raj Signed-off-by: Richard Purdie

bash: fix CVE-2014-6271

2014-09-29T11:16:38+00:00

CVE-2014-6271 aka ShellShock. "GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment." (From OE-Core rev: eb41d5d4eaee1c810f8e418704c110c2005d0197) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

bash: update build-tests.patch

2014-03-05T15:50:21+00:00

(From OE-Core rev: 3c234df240a11903ef3588a2c078dcbce4ca1719) Signed-off-by: Hongxu Jia Signed-off-by: Richard Purdie

bash: upgrade to 4.3

2014-03-05T15:50:20+00:00

The bash-4.2-patches is obsolete. (From OE-Core rev: 31eb09a888729fcfd17d02f2a47375e10e87f79a) Signed-off-by: Hongxu Jia Signed-off-by: Richard Purdie

autotools-brokensep: Mark recipes with broken separate build dir support

2014-02-28T14:01:16+00:00

This patch goes through the OE-Core recipes and marks those which use autotools but don't support a separate build directory (${S} != ${B}). A new class, autotools-brokensep is used for this purpose. This doesn't introduce any change in behaviour in its own right. (From OE-Core rev: 006b8a7808a58713af16c326dc37d07765334b12) Signed-off-by: Richard Purdie

bash: update HOMEPAGE

2014-01-02T12:50:20+00:00

(From OE-Core rev: ec7a9dcacce39e922295a7d84b815b01af27a8b8) Signed-off-by: Paul Eggleton Signed-off-by: Richard Purdie