linux/poky.git/meta/recipes-support/sqlite, branch rocko

sqlite3: fix CVE-2017-13685

2017-10-16T22:52:44+00:00

The dump_callback function in SQLite 3.20.0 allows remote attackers to cause a denial of service (EXC_BAD_ACCESS and application crash) via a crafted file. Backport patch to fix the issue. Some references: https://sqlite.org/src/info/02f0f4c54f2819b3 http://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg105314.html (From OE-Core rev: 9b9f566d2042f2b393de88506d2da964bc4d17b0) Signed-off-by: Wenzong Fan Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

sqlite3: upgrade to 3.2.0

2017-08-18T09:40:27+00:00

* Uprev from 3.19.3 to 3.2.0 for fixing CVE-2017-10989: The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact. https://nvd.nist.gov/vuln/detail/CVE-2017-10989 * LIC_FILES_CHKSUM updated for below changes: -** 2001 September 15 +** 2001-09-15 (From OE-Core rev: 95b802bfe74ac6a3f6dc05edb52c87ef90600f40) Signed-off-by: Wenzong Fan Signed-off-by: Richard Purdie

sqlite3.inc: set CVE_PRODUCT to sqlite

2017-07-24T08:13:31+00:00

It is used in NVD for CVE's like: https://nvd.nist.gov/vuln/detail/CVE-2016-6153 (From OE-Core rev: cec6f26f4d2f16c9a58fac5a6344e3d43b36ed09) Signed-off-by: Mikko Rapeli Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

sqlite3: upgrade to 3.19.3

2017-07-21T21:51:38+00:00

3.19.2 -> 3.19.3 Fixes a bug associated with auto_vacuum that can lead to database corruption. (From OE-Core rev: 2635067901c932888a998ea0fbb45f5d4d3c7c24) Signed-off-by: Maxin B. John Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

sqlite3: upgrade 3.18.0 -> 3.19.2

2017-06-03T22:46:06+00:00

Bug fixes: 1. Fix a problem in REPLACE that can result in a corrupt database containing two or more rows with the same rowid. 2. Fix a problem in PRAGMA integrity_check that was causing a subsequent VACUUM to behave suboptimally. 3. Fix the PRAGMA foreign_key_check command so that it works correctly with foreign keys on WITHOUT ROWID tables. 4. Disallow leading zeros in numeric constants in JSON. 5. Disallow control characters inside of strings in JSON. 6. Limit the depth of recursion for JSON objects and arrays in order to avoid excess stack usage in the recursive descent parser. 7. Fix more bugs in the LEFT JOIN flattening optimization. (From OE-Core rev: 3d4d025b1cc6668fd7baefa01ebb9664e805e83a) Signed-off-by: Maxin B. John Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

sqlite3: upgrade to 3.18.0

2017-05-18T13:01:48+00:00

(From OE-Core rev: 6949d865d3559fa37ff25de4b97c4460b42e0e9c) Signed-off-by: Maxin B. John Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

sqlite3: upgrade to 3.17.0

2017-03-01T23:27:06+00:00

3.16.2 -> 3.17.0 * Approximately 25% better performance from the R-Tree extension. * Other performance improvements. Uses about 6.5% fewer CPU cycles. (From OE-Core rev: 2ecc3dc9cb11feb6804ec08d1b7b1470f01aadbe) Signed-off-by: Maxin B. John Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

sqlite3: upgrade to 3.16.2

2017-01-16T18:05:13+00:00

3.15.2 -> 3.16.2 1. Updated the SRC_URI for releases in 2017 2. Removed the following revert patch as the fix is present in this release: a) 0001-revert-ad601c7962-that-brings-2-increase-of-build-ti.patch [YOCTO #10695] (From OE-Core rev: 05317fe9f11565d40b84ad71300b39c990a53f6d) Signed-off-by: Maxin B. John Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

sqlite3: upgrade to 3.15.2

2017-01-05T13:54:06+00:00

(From OE-Core rev: 12b5e9943da5eece2641665cd091ef709c30214e) Signed-off-by: Maxin B. John Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

meta: remove True option to getVar calls

2016-12-16T10:23:23+00:00

getVar() now defaults to expanding by default, thus remove the True option from getVar() calls with a regex search and replace. Search made with the following regex: getVar ?\(( ?[^,()]*), True\) (From OE-Core rev: 7c552996597faaee2fbee185b250c0ee30ea3b5f) Signed-off-by: Joshua Lock Signed-off-by: Ross Burton Signed-off-by: Richard Purdie