linux/poky.git/meta, branch morty-16.0.1

build-appliance-image: Update to morty head revision

2017-02-08T12:00:36+00:00

(From OE-Core rev: 55c835c73cc41b6fc809c941c295d62a612e49e0) Signed-off-by: Richard Purdie

openssl: CVE: CVE-2017-3731

2017-02-08T12:00:21+00:00

If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. Backported from: https://github.com/openssl/openssl/commit/8e20499629b6bcf868d0072c7011e590b5c2294d https://github.com/openssl/openssl/commit/2198b3a55de681e1f3c23edb0586afe13f438051 * CVE: CVE-2017-3731 Upstream-status: Backport (From OE-Core rev: 1fe1cb3e6e03b4f7f0d30b2b67edc8809a18fe70) Signed-off-by: Alexandru Moise Signed-off-by: Richard Purdie

libx11: CVE-2016-7943

2017-02-08T12:00:21+00:00

The XListFonts function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving length fields, which trigger out-of-bounds write operations. References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7943 https://lists.x.org/archives/xorg-announce/2016-October/002720.html Upstream patch: https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=8c29f1607a31dac0911e45a0dd3d74173822b3c9 (From OE-Core rev: d627e5bd50f66275cb3a77036ea3376a6f1e9a96) Signed-off-by: Sona Sarmadi Signed-off-by: Richard Purdie

libX11: CVE-2016-7942

2017-02-08T12:00:21+00:00

The XGetImage function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving image type and geometry, which triggers out-of-bounds read operations. References https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7942 Upstream patch https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=8ea762f94f4c942d898fdeb590a1630c83235c17 (From OE-Core rev: 6d4421301a54c26e390fa943805574ced6e18c3a) Signed-off-by: Sona Sarmadi Signed-off-by: Richard Purdie

libXrandr: fix for CVE-2016-7947 and CVE-2016-7948

2017-02-08T12:00:21+00:00

CVE-2016-7947 Insufficient validation of server responses result in Integer overflows CVE-2016-7948 Insufficient validation of server responses result in various data mishandlings References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7947 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7948 https://lists.x.org/archives/xorg-announce/2016-October/002720.html Upstream patch for both CVEs: https://cgit.freedesktop.org/xorg/lib/libXrandr/commit/?id=a0df3e1c7728205e5c7650b2e6dce684139254a6 (From OE-Core rev: 1c293e889f6eeae36f8f6ddd9676c65d613ad0fc) Signed-off-by: Sona Sarmadi Signed-off-by: Richard Purdie

libxrender: CVE-2016-7949

2017-02-08T12:00:21+00:00

Insufficient validation of server responses results in overflow of previously reserved memory Upstream patch: https://cgit.freedesktop.org/xorg/lib/libXrender/commit/?id=9362c7ddd1af3b168953d0737877bc52d79c94f4 External References: https://lists.x.org/archives/xorg-announce/2016-October/002720.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7949 (From OE-Core rev: 87ffd7ce2e8ece8b44ff3f1c219a74b3590cf14b) Signed-off-by: Sona Sarmadi Signed-off-by: Richard Purdie

classes: Fix alternatives and rc.d ordering

2017-02-08T12:00:21+00:00

When using an alternative as an initscript, the ordering between update-rc.d and update-alternatives tasks during prerm and postinst tasks must always be the following in order to work: * prerm: - stop daemon - remove alternative * postinst: - add alternative - start daemon This patchset adds comments to the scripts generated by both classes and organize the generated sections based on those comments. [YOCTO #10433] (From OE-Core rev: b0c70bef015f1b2a30556a5db5e255592d5bf316) Signed-off-by: David Vincent Signed-off-by: Ross Burton (cherry picked from commit aa87b1a4dcc14e4dfe719b6c55045c5662bc59c2) Signed-off-by: Richard Purdie

nspr: set correct version in pkg-config file

2017-02-03T09:51:32+00:00

while we are at it clean up sed (From OE-Core rev: 69e9f7ec8ba8649784a27e9c7dc7a6987a53c22e) (From OE-Core rev: cb4f5ecf32006192baaf41218a3d7b43ca1c2951) (From OE-Core rev: 79f821fb6c1b425ca5cb5e6db360c2743d6c989e) Signed-off-by: Andreas Müller Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

attr/ea-acl: pass --disable-gettext when USE_NLS=no

2017-02-03T09:51:32+00:00

Fixes following error in configure: FATAL ERROR: msgfmt does not seem to be installed. attr cannot be built without a working gettext installation. (From OE-Core rev: 85e087d9b323ad87c59900f01aad751c9c7a9e3a) Signed-off-by: Denys Dmytriyenko Signed-off-by: Ross Burton (From OE-Core rev: d044fad8a0ac5d57deb88b25106f3a39cb7c1636) Signed-off-by: Denys Dmytriyenko Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

linux-dtb: strip DTB extension properly in postinst/postrm

2017-02-03T09:51:32+00:00

The use of awk -F "." in do_install/do_deploy to strip filename extension was deprecated long time ago in 72980d5bb465f0640ed451d1ebb9c5d2a210ad0c. Make a similar change in postinst/postrm to properly use basename command. Otherwise DTB files that contain dots in the name result in broken symlinks that point to non-existent truncated files. (From OE-Core rev: ed0f9cf63cb1226f9d92377e13ef63e36a95d29d) Signed-off-by: Denys Dmytriyenko Signed-off-by: Ross Burton (From OE-Core rev: 40c2addf0f0ee16b1c1334cf00f1490ffeaac475) Signed-off-by: Denys Dmytriyenko Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie