linux/poky.git/meta/recipes-extended, branch sumo-next

ed: set CVE vendor to avoid false positives

2019-11-07T19:47:27+00:00

(From OE-Core rev: 2c3d689e4f78d8ea00b1bd2239af80c8fe038074) (From OE-Core rev: 6faf4f340ea8c2b11d609584897a7f5447abc2a0) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Conflicts: meta/recipes-extended/ed/ed_1.15.bb

procps: whitelist CVE-2018-1121

2019-11-07T19:47:27+00:00

This CVE is about race conditions in 'ps' which make it unsuitable for security audits. As these race conditions are unavoidable ps shouldn't be used for security auditing, so this isn't a valid CVE. (From OE-Core rev: b3fa0654abf9ac32f683ac174e453ea5e64b6cb8) (From OE-Core rev: 618a3203d53d33e6403386f1204bcaf327b68f37) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Conflicts: meta/recipes-extended/procps/procps_3.3.15.bb

libpam: set CVE_PRODUCT

2019-11-07T19:47:27+00:00

(From OE-Core rev: f1d5273d53d66b217f3d4975f5cb5eb367b1aab1) (From OE-Core rev: 2395ae4a332928de3f5fcb840ef196e7a7d77386) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Conflicts: meta/recipes-extended/pam/libpam_1.3.1.bb

ghostscript: set CVE_PRODUCT

2019-11-07T19:47:27+00:00

(From OE-Core rev: 721e69aa12dd9ee22618ef13f29fb6d28eeab9af) (From OE-Core rev: 4f905e245a02b9d8c5fe4a77271aabc41a69ba00) Signed-off-by: Chen Qi Signed-off-by: Richard Purdie Conflicts: meta/recipes-extended/ghostscript/ghostscript_9.26.bb

cpio: fix crash when appending to archives

2019-02-25T22:27:46+00:00

The upstream fix for CVE-2016-2037 introduced a read from uninitialized memory bug when appending to an existing archive, which is an operation we perform when building an image. (From OE-Core rev: 046e3e1fca925febf47b3fdd5d4e9ee2e1fad868) (From OE-Core rev: 2ff6ab2e2944c6a53523b4b1611e1d22f6393500) (From OE-Core rev: c0a3874799224c9ae0d6d7dc4d0a0acf364ccdab) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

tzdata/tzcode-native: update to 2018i

2019-02-25T22:27:45+00:00

2018i: Briefly: São Tomé and Príncipe switches from +01 to +00 on 2019-01-01. Changes to future timestamps Due to a change in government, São Tomé and Príncipe switches back from +01 to +00 on 2019-01-01 at 02:00. (Thanks to Vadim Nasardinov and Michael Deckers.) 2018h: Briefly: Qyzylorda, Kazakhstan moved from +06 to +05 on 2018-12-21. New zone Asia/Qostanay because Qostanay, Kazakhstan didn't move. Metlakatla, Alaska observes PST this winter only. Guess Morocco will continue to adjust clocks around Ramadan. Add predictions for Iran from 2038 through 2090. Changes to future timestamps Guess that Morocco will continue to fall back just before and spring forward just after Ramadan, the practice since 2012. (Thanks to Maamar Abdelkader.) This means Morocco will observe negative DST during Ramadan in main and vanguard formats, and in rearguard format it stays in the +00 timezone and observes ordinary DST in all months other than Ramadan. As before, extend this guesswork to the year 2037. As a consequence, Morocco is scheduled to observe three DST transitions in some Gregorian years (e.g., 2033) due to the mismatch between the Gregorian and Islamic calendars. The table of exact transitions for Iranian DST has been extended. It formerly cut off before the year 2038 in a nod to 32-bit time_t. It now cuts off before 2091 as there is doubt about how the Persian calendar will treat 2091. This change predicts DST transitions in 2038-9, 2042-3, and 2046-7 to occur one day later than previously predicted. As before, post-cutoff transitions are approximated. Changes to past and future timestamps Qyzylorda (aka Kyzylorda) oblast in Kazakhstan moved from +06 to +05 on 2018-12-21. This is a zone split as Qostanay (aka Kostanay) did not switch, so create a zone Asia/Qostanay. Metlakatla moved from Alaska to Pacific standard time on 2018-11-04. It did not change clocks that day and remains on -08 this winter. (Thanks to Ryan Stanley.) It will revert to the usual Alaska rules next spring, so this change affects only timestamps from 2018-11-04 through 2019-03-10. Change to past timestamps Kwajalein's 1993-08-20 transition from -12 to +12 was at 24:00, not 00:00. I transcribed the time incorrectly from Shanks. (Thanks to Phake Nick.) Nauru's 1979 transition was on 02-10 at 02:00, not 05-01 at 00:00. (Thanks to Phake Nick.) Guam observed DST irregularly from 1959 through 1977. (Thanks to Phake Nick.) Hong Kong observed DST in 1941 starting 06-15 (not 04-01), then on 10-01 changed standard time to +08:30 (not +08). Its transition back to +08 after WWII was on 1945-09-15, not the previous day. Its 1904-10-30 change took effect at 01:00 +08 (not 00:00 LMT). (Thanks to Phake Nick, Steve Allen, and Joseph Myers.) Also, its 1952 fallback was on 11-02 (not 10-25). This release contains many changes to timestamps before 1946 due to Japanese possession or occupation of Pacific/Chuuk, Pacific/Guam, Pacific/Kosrae, Pacific/Kwajalein, Pacific/Majuro, Pacific/Nauru, Pacific/Palau, and Pacific/Pohnpei. (Thanks to Phake Nick.) Assume that the Spanish East Indies was like the Philippines and observed American time until the end of 1844. This affects Pacific/Chuuk, Pacific/Kosrae, Pacific/Palau, and Pacific/Pohnpei. Changes to past tm_isdst flags For the recent Morocco change, the tm_isdst flag should be 1 from 2018-10-27 00:00 to 2018-10-28 03:00. (Thanks to Michael Deckers.) Give a URL to the official decree. (Thanks to Matt Johnson.) (From OE-Core rev: 100d0d0f24cabedd1a89b69ac8ffb05d85663761) (From OE-Core rev: 40679b9ee29b600a514f2fb82865a0fecca70bf7) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

tzcode-native: update to 2018g

2019-02-25T22:27:45+00:00

Changes to code When generating TZif files with leap seconds, zic no longer uses a format that trips up older 32-bit clients, fixing a bug introduced in 2018f. (Reported by Daniel Fischer.) Also, the zic workaround for QTBUG-53071 now also works for TZif files with leap seconds. The translator to rearguard format now rewrites the line "Rule Japan 1948 1951 - Sep Sat>=8 25:00 0 S" to "Rule Japan 1948 1951 - Sep Sun>=9 1:00 0 S". This caters to zic before 2007 and to Oracle TZUpdater 2.2.0 and earlier. (Reported by Christos Zoulas.) Changes to past time zone abbreviations Change HDT to HWT/HPT for WWII-era abbreviations in Hawaii. This reverts to 2011h, as the abbreviation change in 2011i was likely inadvertent. Changes to documentation tzfile.5 has new sections on interoperability issues. (From OE-Core rev: a24d0c174411a32a2793c89980ca87c4f9d98bc4) (From OE-Core rev: fc8a9e3929a6042bd3d68755799138f417413ab3) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

tzdata: update to 2018g

2019-02-25T22:27:45+00:00

Changes to code When generating TZif files with leap seconds, zic no longer uses a format that trips up older 32-bit clients, fixing a bug introduced in 2018f. (Reported by Daniel Fischer.) Also, the zic workaround for QTBUG-53071 now also works for TZif files with leap seconds. The translator to rearguard format now rewrites the line "Rule Japan 1948 1951 - Sep Sat>=8 25:00 0 S" to "Rule Japan 1948 1951 - Sep Sun>=9 1:00 0 S". This caters to zic before 2007 and to Oracle TZUpdater 2.2.0 and earlier. (Reported by Christos Zoulas.) Changes to past time zone abbreviations Change HDT to HWT/HPT for WWII-era abbreviations in Hawaii. This reverts to 2011h, as the abbreviation change in 2011i was likely inadvertent. Changes to documentation tzfile.5 has new sections on interoperability issues. (From OE-Core rev: 32e5dd919a61b1c245fb6a867d0ea4a71d394aca) (From OE-Core rev: 94c5cc56031b8558cdb75d5d4df05f6715618ab3) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

shadow: improve reproducibility by hard-coding shell path

2018-12-05T22:34:00+00:00

The shadow configure script tries really hard to detect the running shell to make sure it doesn't do unsupported calls. On my system the shell is detected as /bin/sh, while a build in an ubuntu docker it resolves to /bin/bash. And since the shell path is baked into the target binaries through config.h, the build becomes inreproducible. Fix reproducibility by hard-coding the shell to be /bin/sh (From OE-Core rev: 5f4fe91cb6c21cd3ecd0b68d1c6b46a9530c7570) (From OE-Core rev: 83214b835cd82d5dddb47c418c4e7a20ac433f61) Signed-off-by: Martin Hundebøll Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

unzip: actually apply CVE-2018-18384

2018-11-24T21:45:58+00:00

(From OE-Core rev: d8e1b7afc536f989e7e6efdab0998d54f26ad1f6) (From OE-Core rev: 1a42e6401369ffaf02f4711c01f757007f831cc8) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie