linux/poky.git/meta/recipes-extended/grep/grep-2.5.1a/grep-CVE-2012-5667.patch, branch styhead

recipes: Move out stale GPLv2 versions to a seperate layer

2017-03-07T20:05:31+00:00

These are recipes where the upstream has moved to GPLv3 and these old versions are the last ones under the GPLv2 license. There are several reasons for making this move. There is a different quality of service with these recipes in that they don't get security fixes and upstream no longer care about them, in fact they're actively hostile against people using old versions. The recipes tend to need a different kind of maintenance to work with changes in the wider ecosystem and there needs to be isolation between changes made in the v3 versions and those in the v2 versions. There are probably better ways to handle a "non-GPLv3" system but right now having these in OE-Core makes them look like a first class citizen when I believe they have potential for a variety of undesireable issues. Moving them into a separate layer makes their different needs clearer, it also makes it clear how many of these there are. Some are probably not needed (e.g. mc), I also wonder whether some are useful (e.g. gmp) since most things that use them are GPLv3 only already. Someone could now more clearly see how to streamline the list of recipes here. I'm proposing we mmove to this separate layer for 2.3 with its future maintinership and testing to be determined in 2.4 and beyond. (From OE-Core rev: 19b7e950346fb1dde6505c45236eba6cd9b33b4b) Signed-off-by: Richard Purdie

meta: update patch metadata

2016-07-08T08:57:24+00:00

Enforce the correct tag names across all of oe-core for consistency. (From OE-Core rev: 606a43dc38a00cc243f933722db657aea4129f8e) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

Add "CVE:" tag to current patches in OE-core

2016-01-11T23:26:32+00:00

The currnet patches in OE-core doesn't have the "CVE:" tag, now part of the policy of the patches. This is patch add this tag to several patches. There might be patches that I miss; the tag can be added in the future. (From OE-Core rev: 065ebeb3e15311d0d45385e15bf557b1c95b1669) Signed-off-by: Mariano Lopez Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

Upstream-Status: Correct capitalization

2013-07-18T20:23:43+00:00

(From OE-Core rev: 2d5c457bf888771891e9c29e82ec5a5cecace528) Signed-off-by: Saul Wold Signed-off-by: Richard Purdie

grep: fix for CVE-2012-5667

2013-05-30T19:59:11+00:00

Multiple integer overflows in GNU Grep before 2.11 might allow context-dependent attackers to execute arbitrary code via vectors involving a long input line that triggers a heap-based buffer overflow. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5667 (From OE-Core rev: 7dd4d0178e2b057f76cd2b0b6fe8402f8c1ab23d) Signed-off-by: Ming Liu Signed-off-by: Mark Hatle Signed-off-by: Saul Wold Signed-off-by: Richard Purdie