linux/poky.git/meta/recipes-extended, branch thud-20.0.4

libsolv: Security fix for CVEs:

2019-10-15T14:54:01+00:00

(From OE-Core rev: 82a9850d6ef8cca816f9e0a53a8d20b056f95320) Signed-off-by: Muminul Islam CVE: CVE-2018-20532 CVE-2018-20533 CVE-2018-20534 Upstream-Status: Backport Cherry picked from https://github.com/openSUSE/libsolv/pull/291/commits Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

wget: Security fixes CVE-2018-20483

2019-10-10T15:52:30+00:00

Source: http://git.savannah.gnu.org/cgit/wget.git/ Type: Security Fix Disposition: Backport from http://git.savannah.gnu.org/cgit/wget.git/ Description: Fixes CVE-2018-20483 (From OE-Core rev: c901bc8cd9de5853185af2059c6f1efeb4ccdd60) Signed-off-by: Aviraj CJ [Affects Wget before 1.20.1] Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

unzip: fix CVE-2019-13232

2019-10-10T15:52:30+00:00

(From OE-Core rev: 7857d85db69bcb2cb94399a22de6903263e52965) Signed-off-by: Dan Tran Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

ghostscript: Fix 3 CVEs

2019-07-29T22:50:43+00:00

It was discovered that the ghostscript /invalidaccess checks fail under certain conditions. An attacker could possibly exploit this to bypass the -dSAFER protection and, for example, execute arbitrary shell commands via a specially crafted PostScript document. It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. References: https://nvd.nist.gov/vuln/detail/CVE-2019-6116 https://www.openwall.com/lists/oss-security/2019/01/23/5 https://nvd.nist.gov/vuln/detail/CVE-2019-3835 https://nvd.nist.gov/vuln/detail/CVE-2019-3838 Upstream patches: http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=13b0a36 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=2db98f9 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=99f1309 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=59d8f4d http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=2768d1a http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=49c8092 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=2ff600a http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=779664d http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=e8acf6d http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=2055917 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=d683d1e http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=ed9fcd9 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a82601e (From OE-Core rev: 12e140dfdac8456772223c816e37bd869419bb18) (From OE-Core rev: cf5d29dcac6247e8476f7af78b4e0bb129b94677) Signed-off-by: Ovidiu Panait Signed-off-by: Richard Purdie [Fix for CVE-2019-6116 is already in thud, so that has been removed] Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

bzip2: fix CVE-2019-12900

2019-07-29T22:50:43+00:00

Also include a patch to fix regression caused by it. See: https://gitlab.com/federicomenaquintero/bzip2/issues/24 (From OE-Core rev: 7c0b2d228f51aebb4415e63a07bdd645e85b09d8) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

libarchive: integrate security fixes

2019-07-29T22:50:43+00:00

Fix the following CVEs by backporting patches from upstream: - CVE-2019-1000019 - CVE-2019-1000020 - CVE-2018-1000877 - CVE-2018-1000878 - CVE-2018-1000879 - CVE-2018-1000880 (From OE-Core rev: ea251020304b9c18f31c39de867a47311b1bb46c) (From OE-Core rev: 6cba048de29dfea44e926b00e5ea91359e7cbebd) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

lighttpd: fix CVE-2019-11072

2019-07-27T17:05:18+00:00

(From OE-Core rev: 0dbd16a40a28bb75962f38c6ce450c909c22ee79) Signed-off-by: Ross Burton Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

wget: Security fix for CVE-2019-5953

2019-07-27T17:05:18+00:00

Source: http://git.savannah.gnu.org/cgit/wget.git MR: 89341 Type: Security Fix Disposition: Backport from http://git.savannah.gnu.org/cgit/wget.git/commit/?id=692d5c5215de0db482c252492a92fc424cc6a97c ChangeID: 1c19a2fd7ead88cc4ee92d425179d60d4635864b Description: Fixes CVE-2019-5953 Affects: < 1.20.1 (From OE-Core rev: c897b862c6cfaa341cc6155b2c9d98ea7ad02884) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

Tar: Security fix CVE-2019-0023

2019-07-27T17:05:18+00:00

Source: tar.git MR: 97928 Type: Security Fix Disposition: Backport from http://git.savannah.gnu.org/cgit/tar.git/commit/?id=cb07844454d8cc9fb21f53ace75975f91185a120 ChangeID: 7aee4c0daf8ce813242fe7b872583560a32bc4e3 Description: Affects tar < 1.32 fixes CVE-2019-9923 (From OE-Core rev: fc77edc8245ab90eee1f1e857f470b6842dc256f) Signed-off-by: Armin Kuster Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

cups: upgrade to 2.2.10

2019-07-27T17:05:18+00:00

Source: OpenEmbedded.org MR: 97351 Type: Security Fix Disposition: Backport from https://git.openembedded.org/openembedded-core/commit/meta/recipes-extended/cups?h=warrior&id=fbe7a0c9bab7c9be7fd2c0da8b2af61e66de1ebd ChangeID: fbe7a0c9bab7c9be7fd2c0da8b2af61e66de1ebd Description: (From OE-Core rev: 85541b9ae8cff770e2c20a9132c0867a25d190c2) Signed-off-by: Chen Qi Signed-off-by: Richard Purdie CUPS 2.2.10 is a bug fix release that addresses issues in the scheduler, IPP Everywhere support, CUPS library, and USB printer support. Changes include: CVE-2018-4300: Linux session cookies used a predictable random number seed. The lpoptions command now works with IPP Everywhere printers that have not yet been added as local queues (Issue #5045) Added USB quirk rules (Issue #5395, Issue #5443) The generated PPD files for IPP Everywhere printers did not contain the cupsManualCopies keyword (Issue #5433) Kerberos credentials might be truncated (Issue #5435) The handling of MaxJobTime 0 did not match the documentation (Issue #5438) Incorporated the page accounting changes from CUPS 2.3 (Issue #5439) Fixed a bug adding a queue with the -E option (Issue #5440) Fixed a crash bug when mapping PPD duplex options to IPP attributes (rdar://46183976) Signed-off-by: Armin Kuster Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie