Mirror of git.yoctoproject.org/poky https://git.enea.com/cgit/linux/poky.git/atom?h=thud 2017-11-07T13:25:31+00:00 2017-11-07T13:25:31+00:00 Armin Kuster akuster808@gmail.com 2017-11-03T19:54:46+00:00 urn:sha1:e14152226339a76d5192ff9a49d07ed044b071c4 LICENSE files changed: Amend licence to relax its conditions for chains of binary distributions. removed included patches includes CVE-2017-8399 (From OE-Core rev: d8ea0674d1feee803b75cf837e8d029619f8d663) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2017-08-31T16:41:41+00:00 Robert Yang liezhi.yang@windriver.com 2017-08-30T00:48:57+00:00 urn:sha1:d5f2604669820d637fc77acab45dabfa60fc3440 A fuzz on libpcre1 through the pcretest utility revealed an invalid read in the library. For who is interested in a detailed description of the bug, will follow a feedback from upstream: This was a genuine bug in the 32-bit library. Thanks for finding it. The crash was caused by trying to find a Unicode property for a code value greater than 0x10ffff, the Unicode maximum, when running in non-UTF mode (where character values can be up to 0xffffffff). (From OE-Core rev: 1b87201784e733f3a9d436f56cb5a6151ba6bdfa) Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2017-08-31T16:41:41+00:00 Robert Yang liezhi.yang@windriver.com 2017-08-30T00:48:56+00:00 urn:sha1:45f40ea5d904808c1b345ebfa3ccbf8db1ef1c96 The pcre2test.c in PCRE2 10.23 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression. (From OE-Core rev: dd63a26fedb8a578d34850ede4c27e26b8876e7e) Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2017-07-24T08:13:31+00:00 Mikko Rapeli mikko.rapeli@bmw.de 2017-07-20T13:23:00+00:00 urn:sha1:e21383f8e19691bd15cbfb3e7141ffe95d6cda29 It is used in NVD as product name for CVE's like: https://nvd.nist.gov/vuln/detail/CVE-2017-8786 (From OE-Core rev: ce32c5b8ee77012b36c74323f298dc561741aebd) Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2017-06-28T14:52:18+00:00 Fan Xin fan.xin@jp.fujitsu.com 2017-06-21T08:08:30+00:00 urn:sha1:9e0a03725416ade2ae423d8f28d82bc8aa87d4bc 1. Upgrade libpcre2 from 10.22 to 10.23 2. Update the checksum of LIC_FILES_CHKSUM The copyright time of LICENCE is updated to 2017, the content of LICENCE has no change. (From OE-Core rev: ed80c94d0099c5a1a75c1e00805fd09f67b6cbbd) Signed-off-by: Fan Xin <fan.xin@jp.fujitsu.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>