linux/poky.git/meta/recipes-extended, branch thud-next

sudo: Fix CVE-2019-14287

2019-12-16T23:11:10+00:00

(From OE-Core rev: e21a8e3b2b2b035cf71883f72eeb665e3fa9c078) Signed-off-by: Dan Tran Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

tar: Fix CVE-2018-20482

2019-12-16T23:11:10+00:00

(From OE-Core rev: 95ab1519ea5f1a0ed73f6f484bcf15fde5de8140) Signed-off-by: Dan Tran Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

libsolv: Security fix for CVEs:

2019-10-15T14:54:01+00:00

(From OE-Core rev: 82a9850d6ef8cca816f9e0a53a8d20b056f95320) Signed-off-by: Muminul Islam CVE: CVE-2018-20532 CVE-2018-20533 CVE-2018-20534 Upstream-Status: Backport Cherry picked from https://github.com/openSUSE/libsolv/pull/291/commits Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

wget: Security fixes CVE-2018-20483

2019-10-10T15:52:30+00:00

Source: http://git.savannah.gnu.org/cgit/wget.git/ Type: Security Fix Disposition: Backport from http://git.savannah.gnu.org/cgit/wget.git/ Description: Fixes CVE-2018-20483 (From OE-Core rev: c901bc8cd9de5853185af2059c6f1efeb4ccdd60) Signed-off-by: Aviraj CJ [Affects Wget before 1.20.1] Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

unzip: fix CVE-2019-13232

2019-10-10T15:52:30+00:00

(From OE-Core rev: 7857d85db69bcb2cb94399a22de6903263e52965) Signed-off-by: Dan Tran Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

ghostscript: Fix 3 CVEs

2019-07-29T22:50:43+00:00

It was discovered that the ghostscript /invalidaccess checks fail under certain conditions. An attacker could possibly exploit this to bypass the -dSAFER protection and, for example, execute arbitrary shell commands via a specially crafted PostScript document. It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. References: https://nvd.nist.gov/vuln/detail/CVE-2019-6116 https://www.openwall.com/lists/oss-security/2019/01/23/5 https://nvd.nist.gov/vuln/detail/CVE-2019-3835 https://nvd.nist.gov/vuln/detail/CVE-2019-3838 Upstream patches: http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=13b0a36 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=2db98f9 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=99f1309 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=59d8f4d http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=2768d1a http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=49c8092 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=2ff600a http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=779664d http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=e8acf6d http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=2055917 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=d683d1e http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=ed9fcd9 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a82601e (From OE-Core rev: 12e140dfdac8456772223c816e37bd869419bb18) (From OE-Core rev: cf5d29dcac6247e8476f7af78b4e0bb129b94677) Signed-off-by: Ovidiu Panait Signed-off-by: Richard Purdie [Fix for CVE-2019-6116 is already in thud, so that has been removed] Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

bzip2: fix CVE-2019-12900

2019-07-29T22:50:43+00:00

Also include a patch to fix regression caused by it. See: https://gitlab.com/federicomenaquintero/bzip2/issues/24 (From OE-Core rev: 7c0b2d228f51aebb4415e63a07bdd645e85b09d8) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

libarchive: integrate security fixes

2019-07-29T22:50:43+00:00

Fix the following CVEs by backporting patches from upstream: - CVE-2019-1000019 - CVE-2019-1000020 - CVE-2018-1000877 - CVE-2018-1000878 - CVE-2018-1000879 - CVE-2018-1000880 (From OE-Core rev: ea251020304b9c18f31c39de867a47311b1bb46c) (From OE-Core rev: 6cba048de29dfea44e926b00e5ea91359e7cbebd) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

lighttpd: fix CVE-2019-11072

2019-07-27T17:05:18+00:00

(From OE-Core rev: 0dbd16a40a28bb75962f38c6ce450c909c22ee79) Signed-off-by: Ross Burton Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

wget: Security fix for CVE-2019-5953

2019-07-27T17:05:18+00:00

Source: http://git.savannah.gnu.org/cgit/wget.git MR: 89341 Type: Security Fix Disposition: Backport from http://git.savannah.gnu.org/cgit/wget.git/commit/?id=692d5c5215de0db482c252492a92fc424cc6a97c ChangeID: 1c19a2fd7ead88cc4ee92d425179d60d4635864b Description: Fixes CVE-2019-5953 Affects: < 1.20.1 (From OE-Core rev: c897b862c6cfaa341cc6155b2c9d98ea7ad02884) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie