summaryrefslogtreecommitdiffstats
path: root/meta
Commit message (Collapse)AuthorAgeFilesLines
* mtd-utils: Fix alignment trap triggered by NEON instructionsYuanjie Huang2014-12-312-0/+45
| | | | | | | | | | | | | | | | | NEON instruction VLD1.64 was used to copy 64 bits data after type casting, and they will trigger alignment trap. This patch uses memcpy to avoid alignment problem. (From OE-Core rev: a31080021ad3ecfb92220dcb8c717928db268f1e) (From OE-Core rev: bb3606e8312bf339bb888cd5b0bc7e6190e971f7) Signed-off-by: Yuanjie Huang <Yuanjie.Huang@windriver.com> Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: do not replace ccache in the middle of a pathRoy Li2014-12-311-1/+1
| | | | | | | | | | | | | | | | | | | | | Python recipe did a sed s/ccache/$(CCACHE) on the Makefile, which replaces all "ccache" including ones that consist of a full path. This leads to build error when building in a project path with "ccache" in its name. Fix it by only replacing "ccache " with "$(CCACHE) ". Same fix on python 2.xx is: 1181112cf65bc[python: do not replace ccache in the ] (From OE-Core rev: 9f2398a0ff42389052155d971f136a37c5dc80da) (From OE-Core rev: 7e4e2301d95f897e2f91b1c37b56dbd190841acb) Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* multilib.bbclass: fix incorrect TARGET_VENDOR in multilib imageHongxu Jia2014-12-311-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While building multilib extended images such as libXX-core-image-minimal, the WORKDIR has the same dir with the building of core-image-minimal. $ ls tmp/work/qemux86_64-poky-linux/ -al ... drwxrwxr-x 3 jiahongxu jiahongxu 4096 Oct 13 16:01 core-image-minimal drwxrwxr-x 3 jiahongxu jiahongxu 4096 Oct 16 11:11 lib32-core-image-minimal ... While image class is inherited, it did not assign OVERRIDES with 'virtclass-multilib-libXXX', so the reason is variable TARGET_VENDOR was not override for multilib in that situation. It refers what did for PN and MLPREFIX, and manually do the multilib override for TARGET_VENDOR in RecipePreFinalise handler. [YOCTO #6844] (From OE-Core rev: 7ca012fb3addb11ba3f899efa0619ddd8d3c6946) (From OE-Core rev: 733ae9a73704fdb1211a4e35a20f2d6337a16709) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/image: remove obsolete MULTILIB_VENDORSHongxu Jia2014-12-311-11/+0
| | | | | | | | | | | | | | | | | | In oe-core commit 03c5f39b4d7dd8c81e0a130b7d5884e5af039a24, it removed obsolete codes about variable MULTILIB_VENDORS. We clean up the rest obsolete codes related with MULTILIB_VENDORS (From OE-Core rev: 43a1c2dc08b4291e042b6c9ef981bd094ea2c477) (From OE-Core rev: 18be5e2400fb2ca1a46ea504967f3c3522af4fdc) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* elfutils: fix elf_cvt_gnuhashRoy Li2014-12-313-0/+31
| | | | | | | | | | | | | | The 'dest' and 'src' can be same, we need to save the value of src32[2] before swaping it. (From OE-Core rev: b7936bacf0cc89bdda6722d317274bd4a3af840a) (From OE-Core rev: 8a2f0192652b96675b6f5484f7548d4e4106db31) Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* which-2.18: Use foreign strictness to avoid automake errorsJackie Huang2014-12-312-1/+30
| | | | | | | | | | | | | | Fixed: Makefile.am: error: required file './ChangeLog' not found (From OE-Core rev: c84bfa0f519e0bb74aed833a6318c21d91fce377) (From OE-Core rev: 21bffc855ed000d8419badb406343b6410c424b9) Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* image.py: Fix error in graph sortingPascal Bach2014-12-311-1/+1
| | | | | | | | | | | | | | | | | The graph sorting algorithm for image dependencies does a look for an occurrence of a searched string instead of comparing the chunk to the searched string. This leads to the problem that ubifs is recognized as ubi aswell. This fixes this by splitting up the string into chunks. (From OE-Core rev: cec9725c540c2d54c27092e40d159694cea75b5f) (From OE-Core rev: 6fbe9615bd6667b5634fd471e25412fe627acb09) Signed-off-by: Pascal Bach <pascal.bach@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* mklibs: Fix loader for mipselKhem Raj2014-12-313-1/+20
| | | | | | | | | | | | | | Additionally treat ld.so to be searched in sysroot Change-Id: I8b4acb821d9855a1163c7149bc8e369c7c438856 (From OE-Core rev: 4cf539e67333ba2c3fe924b092e104da53e68ca0) (From OE-Core rev: 2c327f75c293a68c39b46d72a27248d72ac80996) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glibc: Delete ldconfig when USE_LDCONFIG is not setKhem Raj2014-12-311-1/+2
| | | | | | | | | | | | | | | This avoids below QA error/warning /sbin/ldconfig [installed-vs-shipped] Change-Id: I028b692eefeaa6e0e0e6507ab4108caa29e41e91 (From OE-Core rev: 2b499db19cd9bd14292457716b50dc62ed90515d) (From OE-Core rev: 267dc0429e8da7cc292034e1a5ab3eae7786db4e) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* rm_work: Speed up rootfs/populate_sdk removalRichard Purdie2014-12-311-0/+12
| | | | | | | | | | | | | | | | | | Commands like bitbake X -c rootfs or bitbake X -c populate_sdk do not trigger rm_work to clean up the directories afterwards since it traditionally hooks onto do_build. This change means those two tasks now clean up after themselves. We use the cleandirs function attribute to handle this. [YOCTO #6413] (From OE-Core rev: 6bf06d80c2ce03dfdedac5ad8cf42ef8e36b0ecb) (From OE-Core rev: 38b1f9d8e4fa9afb8644e4be55191fbe5cfd99a1) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python: fix ssl import errorMaxin B. John2014-12-311-1/+1
| | | | | | | | | | | | | | | | | | | | | | | Fix this ssl import error: Python 2.7.3 (default, Dec 5 2014, 16:24:17) [GCC 4.9.1] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> import ssl Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/usr/lib/python2.7/ssl.py", line 92, in <module> import base64 # for DER-to-PEM translation ImportError: No module named base64 (From OE-Core rev: dfa34e70a4c7543dc67835c2e9a270ccd011ac72) (From OE-Core rev: 2defde75799c669d531fddee005758ec13884aab) Signed-off-by: Maxin B. John <maxin.john@enea.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cpio: fix bug CVE-2014-9112 for cpio-2.11Bian Naimeng2014-12-312-1/+222
| | | | | | | | | | | | | | | | Obtain detain from following URL. http://lists.gnu.org/archive/html/bug-cpio/2014-12/msg00000.html http://git.savannah.gnu.org/cgit/cpio.git/commit/?id=746f3ff670dcfcdd28fcc990e79cd6fccc7ae48d (From OE-Core rev: 9a32da05f5a9bc62c592fd2d6057dc052e363261) (From OE-Core rev: f5c196fdde79402119ae1893c6150b4bfbc137a1) Signed-off-by: Bian Naimeng <biannm@cn.fujitsu.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cpio: fix bug CVE-2014-9112 for cpio-2.8Bian Naimeng2014-12-312-3/+221
| | | | | | | | | | | | | | | | Obtain detain from following URL. http://lists.gnu.org/archive/html/bug-cpio/2014-12/msg00000.html http://git.savannah.gnu.org/cgit/cpio.git/commit/?id=746f3ff670dcfcdd28fcc990e79cd6fccc7ae48d (From OE-Core rev: 732fc8de55a9c7987608162879959c03423de907) (From OE-Core rev: 695d14dc92d7de89ae02dac0928f184519b8b57d) Signed-off-by: Bian Naimeng <biannm@cn.fujitsu.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kernel.bbclass: Create modules directory even if there is no modules installedHe Zhe2014-12-311-0/+1
| | | | | | | | | | | | | | | | | | | During kernel_do_install it needs to make symbol link at ${D}/lib/modules/${KERNEL_VERSION}/build, but there will not be ${D}/lib/modules/${KERNEL_VERSION} if there is no modules installed for current image, which will result in a build failure. Add "mkdir -p ${D}/lib/modules/${KERNEL_VERSION}" here to avoid this failure and the need of similar changes in other scripts that also expect it to exist. (From OE-Core rev: f2f72f8ff623d24fffbb1b0ad40bc08f05ff31dd) (From OE-Core rev: a3dae5c091017827a293affbb8ade179a23efd6d) Signed-off-by: He Zhe <zhe.he@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gst-ffmpeg: fixes for CVE-2014-8548 and CVE-2014-8541Roy Li2014-12-313-0/+102
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Issue: LIN7-1755 Issue: LIN7-1739 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8541 libavcodec/mjpegdec.c in FFmpeg before 2.4.2 considers only dimension differences, and not bits-per-pixel differences, when determining whether an image size has changed, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted MJPEG data. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8548 Off-by-one error in libavcodec/smc.c in FFmpeg before 2.4.2 allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted Quicktime Graphics (aka SMC) video data. (From OE-Core rev: 4bd50c5a967af2b8f0fe77b8f9c100169e4fc531) (From OE-Core rev: fad70ea3495329a39329532f59de3b14c22c2d15) Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* buildtools-tarball: package all of PythonRoss Burton2014-12-111-24/+1
| | | | | | | | | | | Instead of cherry-picking pieces of Python to put into the buildtools tarball, ship all of it. We can't predict what bits of Python will be needed in the future. (From OE-Core rev: 1cf1edcd28a002291622d04dd2d0ee2c67e329e4) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* babeltrace: Backport fix for unaligned integerSaul Wold2014-11-262-0/+253
| | | | | | | | | | [YOCTO #6464] (From OE-Core rev: 7c04085a0b5f978d7fd07f83b0799abbeb3b7052) Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* xkeyboard-config: Inherit gettextAndrei Gherzan2014-11-261-1/+1
| | | | | | | | | | | | | | | | | | | | In a GPLv3-free build we have two different versions of gettext in sysroot due to GPLv3 restrictions. In this case we need gettext-native too so we can have the needed macros and avoid errors like: "error: possibly undefined macro: AM_GNU_GETTEXT" The needed dependency is added by gettext class which is prefered because it takes care of NLS flags too. (From OE-Core rev: 23d8a4d64e9ff126d6460a69e6d086b1c86e87a9) (From OE-Core rev: 1975981e7777748c2b45b16e47ec704a9c37b56b) Signed-off-by: Andrei Gherzan <andrei.gherzan@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* package_manager: DpkgPM fix populate_sdkAníbal Limón2014-11-261-1/+1
| | | | | | | | | | | | | | | | | | DpkgPM change all_arch_list variable set from PACKAGE_ARCHS to passed archs variable because is different when is executed from rootfs.py and sdk.py. Credits to: Ricardo Ribalda <ricardo.ribalda@gmail.com> (From OE-Core rev: f6fb8c16f49fd9a2b124ad55f5c4fed82d7e6dca) (From OE-Core rev: d9612ac36d59eb9e800f06339965d66f27c66ae0) Signed-off-by: Aníbal Limón <anibal.limon@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python: Fix CVE-2014-7185Wenzong Fan2014-11-262-0/+76
| | | | | | | | | | | | | | | | | | | | | | | Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive information from process memory via a large size and offset in a "buffer" function. This back-ported patch fixes CVE-2014-7185 (From OE-Core rev: 49ceed974e39ab8ac4be410e5caa5e1ef7a646d9) (From OE-Core rev: 3dd696e03e66fa98b58a17b7f34ffe4002ddc9c6) Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Conflicts: meta/recipes-devtools/python/python_2.7.3.bb hand merged bb file since I did not take previous patch. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow-securetty: add ttyAM[0-3] serial portsJavier Viguera2014-11-261-0/+4
| | | | | | | | | | | | | | Old version of the ARM AMBA serial port driver creates those device nodes. (From OE-Core rev: fa17b9ea435f5c49e3bea56524152b21d915d464) (From OE-Core rev: 0956df1596f899337afb3551db01a59bf1c38856) Signed-off-by: Javier Viguera <javier.viguera@digi.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* nss: CVE-2014-1568Chong Lu2014-11-242-0/+671
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the patch comes from: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1568 https://bugzilla.mozilla.org/show_bug.cgi?id=1064636 nss ng log: ===== changeset: 11252:ad411fb64046 user: Kai Engert <kaie@kuix.de> date: Tue Sep 23 19:28:34 2014 +0200 summary: Fix bug 1064636, patch part 2, r=rrelyea ===== changeset: 11253:4e90910ad2f9 user: Kai Engert <kaie@kuix.de> date: Tue Sep 23 19:28:45 2014 +0200 summary: Fix bug 1064636, patch part 3, r=rrelyea ===== changeset: 11254:fb7208e91ae8 user: Kai Engert <kaie@kuix.de> date: Tue Sep 23 19:28:52 2014 +0200 summary: Fix bug 1064636, patch part 1, r=rrelyea ===== changeset: 11255:8dd6c6ac977d user: Kai Engert <kaie@kuix.de> date: Tue Sep 23 19:39:40 2014 +0200 summary: Bug 1064636, follow up commit to fix Windows build bustage (From OE-Core rev: 0ed9070619f959b802dcc4ee8399d252d0349583) Signed-off-by: Li Wang <li.wang@windriver.com> Signed-off-by: Chong Lu <Chong.Lu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Fixup line ending merge issuesRichard Purdie2014-11-242-16/+16
| | | | | | | | | Somehow the patch line endings got messed up during merge. This restores the delta. (From OE-Core rev: 5dee4e241d64e6144d74967cca583d249689773a) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* serf: uprev to 1.3.7 for fixing CVE-2014-3504Wenzong Fan2014-11-211-3/+3
| | | | | | | | | | | | | | | | The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_- ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in- the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3504 (From OE-Core rev: 832aa4c5a7989636dae3068f508ab2bff8b4ab23) Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* tzdata: update to 2014jArmin Kuster2014-11-211-0/+6
| | | | | | | | | | | | (From OE-Core rev: 3ab9dfb703835fee21fd73c4e5cbad1c34c6a163) (From OE-Core rev: 06ffe5637f23f6036aaf58b40f7f9a721624cd5b) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* tzcode: update to 2014jArmin Kuster2014-11-211-0/+10
| | | | | | | | | | | | (From OE-Core rev: 2f8940e8b2a0537f131a6d5410e85bba07a8c116) (From OE-Core rev: 429077a21c7753dee64ea869a73309903b659f6a) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Security Advisory - curl - CVE-2014-3620Chong Lu2014-11-212-0/+70
| | | | | | | | | | | | | | | | libcurl wrongly allows cookies to be set for Top Level Domains (TLDs), thus making them apply broader than cookies are allowed. This can allow arbitrary sites to set cookies that then would get sent to a different and unrelated site or domain. (From OE-Core rev: ddbaade8afbc9767583728bfdc220639203d6853) (From OE-Core rev: db194a3af25a37ff2d6f091ef021894967ca5910) Signed-off-by: Chong Lu <Chong.Lu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Security Advisory - curl - CVE-2014-3613Chong Lu2014-11-212-0/+270
| | | | | | | | | | | | | | | | By not detecting and rejecting domain names for partial literal IP addresses properly when parsing received HTTP cookies, libcurl can be fooled to both sending cookies to wrong sites and into allowing arbitrary sites to set cookies for others. (From OE-Core rev: 985ef933208da1dd1f17645613ce08e6ad27e2c1) (From OE-Core rev: 7c4dfa64fd88066f2e0fbc917d8660f5b35e00c4) Signed-off-by: Chong Lu <Chong.Lu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* subversion: Security Advisory - subversion - CVE-2014-3528Yue Tao2014-11-213-0/+31
| | | | | | | | | | | | | | | | | | | | Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3528 (From OE-Core rev: e0dc0432b13f38d16f642bdadf8ebc78b7a74806) (From OE-Core rev: 4ff3355e4daf841c66fb78e88bf2d6e26d8f9ced) Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* subversion: Security Advisory - subversion - CVE-2014-3522Yue Tao2014-11-214-1/+887
| | | | | | | | | | | | | | | | | | | | | | | The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 does not properly handle wildcards in the Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.<a href=http://cwe.mitre.org/data/definitions/297.html target=_blank>CWE-297: Improper Validation of Certificate with Host Mismatch</a> http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3522 (From OE-Core rev: 06a33cd00ea11abec1ebe9d5883e44778075ccc6) (From OE-Core rev: 529ce75be949944a6e54151cd4233703e40c6351) Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta-environment: Fix config-site with a multilib configMark Hatle2014-11-133-5/+8
| | | | | | | | | | | | | | | | | | | | [YOCTO #6951] The TOOLCHAIN_CONFIGSITE_SYSROOTCACHE value was defaulting to the nativesdk path and not the associated target path. Set the value in toolchain-scripts to the target path. Be sure to set the MLPREFIX within the meta-environment script as multilibs are processed. Update the config_site file name to use -BPN- not PN. Otherwise the environment processing can't find the correct filename. (From OE-Core rev: 26a2f98155a867a71217e52d33f761dcc60800ca) Signed-off-by: Mark Hatle <mark.hatle@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* readline: Patch for readline multikey dispatch issueSaul Wold2014-11-072-1/+34
| | | | | | | | | (From OE-Core rev: 4fc3553cfecb42c124b7cfff8e0d20ade14a3ffc) Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wget: Fix for CVE-2014-4887Saul Wold2014-11-072-0/+79
| | | | | | | | | (From OE-Core rev: 6815a99d6735a39f4af09726d4f514ac27801406) Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* license.bbclass: canonicalise the licenses named with 'X+'Jackie Huang2014-11-051-2/+9
| | | | | | | | | | | | | | | | | | If INCOMPATIBLE_LICENSE=GPLv3, GPLv3+ should be excluded as well but not now since there is no SPDXLICENSEMAP for licenses named with 'X+', we can add all the SPDXLICENSEMAP settings for licenses named with 'X+' in licenses.conf, but it's more like a duplication, so improve the canonical_license function to auto map for 'X+' if SPDXLICENSEMAP for 'X' is available, so GPLv3+ becomes GPL-3.0+. (From OE-Core rev: 1d6dab1dbbbfbcb32e58dba3111130157ef2b24f) (From OE-Core rev: 652008fd9dc909836819e5c6808c63643eff6db6) Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* nativesdk-cmake: Adjust toolchain paths dynamicallyOtavio Salvador2014-10-313-0/+33
| | | | | | | | | | | This patch adds a flexible way to configure the CMake in SDKs. It adds a toolchain configuration script which supports subscripts for extensions, as for example Qt5. (From OE-Core rev: 484502e4e062fae1130a60626f39f5512af4c5c8) Signed-off-by: Otavio Salvador <otavio@ossystems.com.br> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: Use ${ROOT_HOME} instead of /rootDan McGregor2014-10-312-1/+182
| | | | | | | | | | | | | systemd avoids using nss lookups for the root user, so naturally it assumes that root's home directory is /root. In OE that's not the case, and it can lead to long delays when shutting down due to user shutdown unit failures. (From OE-Core rev: e0e8a904cd287a23352e5713a93aeab3933e4563) Signed-off-by: Dan McGregor <dan.mcgregor@usask.ca> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to dizzy head revisionRichard Purdie2014-10-181-1/+1
| | | | | | (From OE-Core rev: 97756472d3a69eaca95d105494ffea78c6b077e0) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gst-ffmpeg: Security Advisory - ffmpeg - CVE-2013-0869Yue Tao2014-10-182-0/+34
| | | | | | | | | | | | | | | The field_end function in libavcodec/h264.c in FFmpeg before 1.1.2 allows remote attackers to have an unspecified impact via crafted H.264 data, related to an SPS and slice mismatch and an out-of-bounds array access. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0869 (From OE-Core rev: 464123172c92d92fa08e2125c04653590ad654c7) Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gst-ffmpeg: Security Advisory - ffmpeg - CVE-2013-4358Yue Tao2014-10-182-0/+146
| | | | | | | | | | | | | | libavcodec/h264.c in FFmpeg before 0.11.4 allows remote attackers to cause a denial of service (crash) via vectors related to alternating bit depths in H.264 data. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4358 (From OE-Core rev: 6a029bee3da097b9ed8c421fcd5ea61cd1a31b34) Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* mtools: fix broken /usr/bin/lzWenlin Kang2014-10-182-1/+26
| | | | | | | | | | | | | | | | | | | | | | | When build fs with mtools-3.9.9, has file /usr/bin/lz in rootfs, it is the symlink to uz: root@qemu3:~# /usr/bin/lz -sh: /usr/bin/lz: No such file or directory $root@qemu3:~# ls -l /usr/bin/lz lrwxrwxrwx 1 root root 2 Jul 18 18:07 /usr/bin/lz -> uz root@qemu3:~# uz -sh: uz: command not found But the uz isn't actually exist, so the result is that lz is a broken symlink. The root cause is that uz hasn't been installed when install-scripts. (From OE-Core rev: 7308da9ccd4b8b9b5077aacd0442be28a6c73c61) Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com> Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gnupg_1.4.7: add package config libusbKai Kang2014-10-181-0/+1
| | | | | | | | | | | | | If build gnupg 1.4.7 after libusb-compat, it shows warning: WARNING: QA Issue: gnupg rdepends on libusb-compat, but it isn't a build dependency? [build-deps] Add package config libusb to fix it. (From OE-Core rev: e1c77392143e538a2305f63ee3add611ec66e877) Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: upgrade to 1.0.1jRoss Burton2014-10-181-2/+2
| | | | | | | (From OE-Core rev: 390916b8400a46088c71183aef6e17b947cf4b74) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* readline: Security Advisory - readline - CVE-2014-2524Kai Kang2014-10-182-0/+45
| | | | | | | | | | | | | | The _rl_tropen function in util.c in GNU readline before 6.3 patch 3 allows local users to create or overwrite arbitrary files via a symlink attack on a /var/tmp/rltrace.[PID] file. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2524 (From OE-Core rev: 0e95eef8817f51504dcc50d855dcbef172cfc897) Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gnupg: CVE-2013-4242Kai Kang2014-10-182-0/+63
| | | | | | | | | | | | | | | | GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload. Patch from commit e2202ff2b704623efc6277fb5256e4e15bac5676 in git://git.gnupg.org/libgcrypt.git (From OE-Core rev: d1e0f3e71ce9978ff0fc94d71e67b528dad84c5c) Signed-off-by: Yong Zhang <yong.zhang@windriver.com> Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sstate.bbclass: Fix up white space lost in last commit.Peter Urbanec2014-10-181-20/+20
| | | | | | | | | | | Commit e9672387 split one long line into a multi-line string, but in the process white space between words was lost. This results in badly formatted output when this message is printed. (From OE-Core rev: b145374c0a498de0160a9b81f50ce0066ab14862) Signed-off-by: Peter Urbanec <openembedded-devel@urbanec.net> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sstate.bbclass: specify func dirs for sstate_hardcode_pathWenzong Fan2014-10-181-0/+5
| | | | | | | | | | | | | | | | | | | | | For some recipes that inhrient cmake, the ${B} may be removed by cmake_do_configure() while sstate_hardcode_path() running, this causes build errors: Exception: OSError: [Errno 2] No such file or directory: \ '/path/to/build' The function sstate_hardcode_path() called command: $SSTATE_SCAN_CMD which extended as "find ${SSTATE_BUILDDIR} ..." So the proper function dirs could be ${SSTATE_BUILDDIR}. (From OE-Core rev: a949943e622b08485fc7632a0a743bc009079c67) Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* file: add wrapper to nativesdk-fileHongxu Jia2014-10-181-0/+5
| | | | | | | | | | | | | | | | | | "file" command in exported SDK doesn't work: ... $ file sysroots/ file: could not find any valid magic files! ... In oe-core commit 68d548cbae729eaea8ce1403dc95ff63c4a7375c, it added wrapper to file-native. Do the same thing for nativesdk-file. (From OE-Core rev: 69a3ab38d1c725c2b575065739cae4a3b45015a2) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: avoid screen sessions being killed on disconnect with systemdPaul Eggleton2014-10-181-0/+1
| | | | | | | | | | | | | | | Tell systemd just to kill the sshd process when the ssh connection drops instead of the entire cgroup for sshd, so that any screen sessions (and more to the point, processes within them) do not get killed. (This is what the Fedora sshd service file does, and what we're already doing in the dropbear service file). (From OE-Core rev: 3c238dff41fbd3687457989c7b17d22b2cc844be) Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python: force off_t size to 8 to enable large file supportPaul Eggleton2014-10-181-0/+3
| | | | | | | | | | | | | | | If DISTRO_FEATURES contains "largefile", force the size of off_t to 8 as a workaround for having ac_cv_sizeof_off_t=4 on 32-bit systems. In future we will likely drop the value from the site file, but for now this is a slightly safer fix. Fixes [YOCTO #6813]. (From OE-Core rev: a8216030ee6c65531de8fbf3eed878a345a94edc) Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to dizzy head revisionRichard Purdie2014-10-111-1/+1
| | | | | | (From OE-Core rev: fcbd1b19383daf5e160a864df1418130da01be28) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-08-13 21:41:43 +0000