linux/poky.git/meta/recipes-multimedia, branch pyro

libpng: update SRC_URI to use osl

2018-05-07T14:57:43+00:00

ERROR: libpng-1.6.28-r0 do_checkuri: Fetcher failure for URL: 'http://downloads.sourceforge.net/project/libpng/libpng16/1.6.28/libpng-1.6.28.tar.xz'. URL http://downloads.sourceforge.net/project/libpng/libpng16/1.6.28/libpng-1.6.28.tar.xz doesn't work ERROR: libpng-1.6.28-r0 do_checkuri: Function failed: do_checkuri (From OE-Core rev: c53d61712a50c5243b14b6aa39e034e080fa0bd3) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

libpng: fix MIRRORS usage

2018-05-07T14:57:43+00:00

MIRRORS needs to be pairs of values for the original URL to match and the location find it on the mirror. (From OE-Core rev: a649f3da630e8ca2d3ca58b610f3918720dd5229) (From OE-Core rev: 1ea5d9f4d2afab924635462a35badfc55bd43c9c) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

libpng: use SourceForge mirror

2018-05-07T14:57:43+00:00

The Gentoo mirror also deletes old versions when they're not used, so revert back to the canonical SourceForge site, adding /older-releases/ to MIRRORS to handle new releases moving the version we want. Original idea by Maxin B. John . (From OE-Core rev: 791a3493c88c9c249f21f6d893b2061e1d8a0af6) (From OE-Core rev: 8ced3de463f97930404fe83a9f30d5d6536ffc9b) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie [Updated for Pyro context] Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

libvorbis: CVE-2018-5146

2018-04-02T16:06:25+00:00

Prevent out-of-bounds write in codebook decoding. The bug could allow code execution from a specially crafted Ogg Vorbis file. References: https://www.debian.org/security/2018/dsa-4140 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5146 (From OE-Core rev: 5c880fe974907195c563b5580cb43b3b2fb92203) Signed-off-by: Tanu Kaskinen Signed-off-by: Richard Purdie

libvorbis: CVE-2017-14632

2018-04-02T16:06:25+00:00

Xiph.Org libvorbis 1.3.5 allows Remote Code Execution upon freeing uninitialized memory in the function vorbis_analysis_headerout() in info.c when vi->channels<=0, a similar issue to Mozilla bug 550184. References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14632 (From OE-Core rev: e584aca38396db5e3d461f57804519261eecedc2) Signed-off-by: Tanu Kaskinen Signed-off-by: Richard Purdie

libvorbis: CVE-2017-14633

2018-04-02T16:06:25+00:00

In Xiph.Org libvorbis 1.3.5, an out-of-bounds array read vulnerability exists in the function mapping0_forward() in mapping0.c, which may lead to DoS when operating on a crafted audio file with vorbis_analysis(). References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14633 (From OE-Core rev: 3ea65ee8b31a16a20f5c28c19f4c758f8deabf6e) Signed-off-by: Tanu Kaskinen Signed-off-by: Richard Purdie

tiff: Security fix for CVE-2017-7593

2017-11-05T22:39:49+00:00

(From OE-Core rev: b6ec8ab42befaa07c859a5c5cc14611b821a1304) Signed-off-by: Rajkumar Veer Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

tiff: Security fix for CVE-2017-7602

2017-11-05T22:39:49+00:00

(From OE-Core rev: 957e9f92b17c6b268e6c037666d2f32ef23f7bf9) Signed-off-by: Rajkumar Veer Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

tiff: Security fix for CVE-2017-7601

2017-11-05T22:39:49+00:00

(From OE-Core rev: 7423b8318a381d139590f6ab2c50874d0eb775a6) Signed-off-by: Rajkumar Veer Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

tiff: Security fix for CVE-2017-7598

2017-11-05T22:39:49+00:00

(From OE-Core rev: 13704be6d172eef2459bb3a5ceed47711ef08b99) Signed-off-by: Rajkumar Veer Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie