]> code.ossystems Code Review - openembedded-core.git/log
openembedded-core.git
8 years agopython-2.7: Security fix CVE-2016-0772
Armin Kuster [Sun, 6 Nov 2016 18:27:08 +0000 (10:27 -0800)]
python-2.7: Security fix CVE-2016-0772

Affects python < 2.7.12

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssl: Security fix CVE-2016-8610
Armin Kuster [Sun, 6 Nov 2016 15:33:27 +0000 (07:33 -0800)]
openssl: Security fix CVE-2016-8610

affects openssl < 1.0.2i

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssl: Security fix CVE-2016-2179
Armin Kuster [Sun, 6 Nov 2016 14:54:25 +0000 (06:54 -0800)]
openssl: Security fix CVE-2016-2179

affects openssl < 1.0.2i

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agobind: Security fix CVE-2016-2776
Armin Kuster [Mon, 3 Oct 2016 00:52:11 +0000 (17:52 -0700)]
bind: Security fix CVE-2016-2776

affect bind < 9.10.4-p3

Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agobind: Security fix CVE-2016-2775
Armin Kuster [Mon, 3 Oct 2016 00:49:24 +0000 (17:49 -0700)]
bind: Security fix CVE-2016-2775

affect bind < 9.10.4-p2

Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agognutils: Security fix CVE-2016-7444
Armin Kuster [Mon, 3 Oct 2016 00:11:14 +0000 (17:11 -0700)]
gnutils: Security fix CVE-2016-7444

affects gnutls < 3.3.24

Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agognupg: fix find-version for beta checking
Wenzong Fan [Wed, 28 Oct 2015 05:53:37 +0000 (01:53 -0400)]
gnupg: fix find-version for beta checking

find-version always assumes that gnupg is beta if autogen.sh is run
out of git-repo. This doesn't work for users whom just take release
tarball and re-run autoconf in their local build dir.

This fixes runtime issue:

  $gpg --list-sigs
  gpg: NOTE: THIS IS A DEVELOPMENT VERSION!
  gpg: It is only intended for test purposes and should NOT be
  gpg: used in a production environment or with production keys!

Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
8 years agoperl: fix CVE-2016-1238
Mingli Yu [Mon, 26 Sep 2016 06:00:42 +0000 (14:00 +0800)]
perl: fix CVE-2016-1238

Backport patch to fix CVE-2016-1238 from perl upstream:
http://perl5.git.perl.org/perl.git/commitdiff/cee96d52c39b1e7b36e1c62d38bcd8d86e9a41ab

(From OE-Core rev: 7d06ffcbcd0c71dc6dc9efde02bf0cd8d7c7d7e3)

Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fixed up to apply to 5.20.0
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoperl: fix CVE-2015-8607
Mingli Yu [Wed, 21 Sep 2016 09:47:32 +0000 (17:47 +0800)]
perl: fix CVE-2015-8607

Backport patch to fix CVE-2015-8607 from perl upstream:
http://perl5.git.perl.org/perl.git/commitdiff/0b6f93036de171c12ba95d415e264d9cf7f4e1fd

(From OE-Core rev: e2289647ace9ef96e6a7e4aae201fd9149e56678)

Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
fixed up to apply to 5.22.0
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoperl: fix CVE-2016-6185
Mingli Yu [Wed, 21 Sep 2016 09:47:31 +0000 (17:47 +0800)]
perl: fix CVE-2016-6185

Backport patch to fix CVE-2016-6185 from perl upstream:
http://perl5.git.perl.org/perl.git/commitdiff/08e3451d7

(From OE-Core rev: 81e550d0c23c9842b85207cdfa73bbe9102e01fb)

Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
fixed up to apply against 5.22.0
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoperl: fix CVE-2016-2381
Kai Kang [Thu, 14 Jul 2016 08:53:08 +0000 (16:53 +0800)]
perl: fix CVE-2016-2381

Backport patch to fix CVE-2016-2381 from perl upstream:

http://perl5.git.perl.org/perl.git/commitdiff/ae37b791a73a9e78dedb89fb2429d2628cf58076

(From OE-Core rev: 07ca8a0131f43e9cc2f720e1cdbcb7ba7c074886)

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fixed up to apply again 5.22.0
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agotzdata: update to 2016g
Armin Kuster [Wed, 28 Sep 2016 23:42:35 +0000 (16:42 -0700)]
tzdata: update to 2016g

LICENSE md5sum changed do to rewording some text not released to the license.
see https://github.com/eggert/tz/commit/8c143a2b65fdfd43a7911be6fdb700c9c4553f58

  Changes to future time stamps

    Turkey switched from EET/EEST (+02/+03) to permanent +03,
    effective 2016-09-07.  (Thanks to Burak AYDIN.)  Use "+03" rather
    than an invented abbreviation for the new time.

    New leap second 2016-12-31 23:59:60 UTC as per IERS Bulletin C 52.
    (Thanks to Tim Parenti.)

  Changes to past time stamps

    For America/Los_Angeles, spring-forward transition times have been
    corrected from 02:00 to 02:01 in 1948, and from 02:00 to 01:00 in
    1950-1966.

    For zones using Soviet time on 1919-07-01, transitions to UT-based
    time were at 00:00 UT, not at 02:00 local time.  The affected
    zones are Europe/Kirov, Europe/Moscow, Europe/Samara, and
    Europe/Ulyanovsk.  (Thanks to Alexander Belopolsky.)

  Changes to past and future time zone abbreviations

    The Factory zone now uses the time zone abbreviation -00 instead
    of a long English-language string, as -00 is now the normal way to
    represent an undefined time zone.

    Several zones in Antarctica and the former Soviet Union, along
    with zones intended for ships at sea that cannot use POSIX TZ
    strings, now use numeric time zone abbreviations instead of
    invented or obsolete alphanumeric abbreviations.  The affected
    zones are Antarctica/Casey, Antarctica/Davis,
    Antarctica/DumontDUrville, Antarctica/Mawson, Antarctica/Rothera,
    Antarctica/Syowa, Antarctica/Troll, Antarctica/Vostok,
    Asia/Anadyr, Asia/Ashgabat, Asia/Baku, Asia/Bishkek, Asia/Chita,
    Asia/Dushanbe, Asia/Irkutsk, Asia/Kamchatka, Asia/Khandyga,
    Asia/Krasnoyarsk, Asia/Magadan, Asia/Omsk, Asia/Sakhalin,
    Asia/Samarkand, Asia/Srednekolymsk, Asia/Tashkent, Asia/Tbilisi,
    Asia/Ust-Nera, Asia/Vladivostok, Asia/Yakutsk, Asia/Yekaterinburg,
    Asia/Yerevan, Etc/GMT-14, Etc/GMT-13, Etc/GMT-12, Etc/GMT-11,
    Etc/GMT-10, Etc/GMT-9, Etc/GMT-8, Etc/GMT-7, Etc/GMT-6, Etc/GMT-5,
    Etc/GMT-4, Etc/GMT-3, Etc/GMT-2, Etc/GMT-1, Etc/GMT+1, Etc/GMT+2,
    Etc/GMT+3, Etc/GMT+4, Etc/GMT+5, Etc/GMT+6, Etc/GMT+7, Etc/GMT+8,
    Etc/GMT+9, Etc/GMT+10, Etc/GMT+11, Etc/GMT+12, Europe/Kaliningrad,
    Europe/Minsk, Europe/Samara, Europe/Volgograd, and
    Indian/Kerguelen.  For Europe/Moscow the invented abbreviation MSM
    was replaced by +05, whereas MSK and MSD were kept as they are not
    our invention and are widely used.

  Changes to zone names

    Rename Asia/Rangoon to Asia/Yangon, with a backward compatibility link.
    (Thanks to David Massoud.)

(From OE-Core rev: d1341aeda6d9fa5d7f13afabadae60a6fc295b87)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agotzcode-native: Update to 2016g
Armin Kuster [Wed, 28 Sep 2016 23:42:34 +0000 (16:42 -0700)]
tzcode-native: Update to 2016g

LICENSE file checksum changed do to a verbage change.

  Changes to code

    zic no longer generates binary files containing POSIX TZ-like
    strings that disagree with the local time type after the last
    explicit transition in the data.  This fixes a bug with
    Africa/Casablanca and Africa/El_Aaiun in some year-2037 time
    stamps on the reference platform.  (Thanks to Alexander Belopolsky
    for reporting the bug and suggesting a way forward.)

    If the installed localtime and/or posixrules files are symbolic
    links, zic now keeps them symbolic links when updating them, for
    compatibility with platforms like OpenSUSE where other programs
    configure these files as symlinks.

    zic now avoids hard linking to symbolic links, avoids some
    unnecessary mkdir and stat system calls, and uses shorter file
    names internally.

    zdump has a new -i option to generate transitions in a
    more-compact but still human-readable format.  This option is
    experimental, and the output format may change in future versions.
    (Thanks to Jon Skeet for suggesting that an option was needed,
    and thanks to Tim Parenti and Chris Rovick for further comments.)

  Changes to build procedure

    An experimental distribution format is available, in addition
    to the traditional format which will continue to be distributed.
    The new format is a tarball tzdb-VERSION.tar.lz with signature
    file tzdb-VERSION.tar.lz.asc.  It unpacks to a top-level directory
    tzdb-VERSION containing the code and data of the traditional
    two-tarball format, along with extra data that may be useful.
    (Thanks to Antonio Diaz Diaz, Oscar van Vlijmen, and many others
    for comments about the experimental format.)

    The release version number is now more accurate in the usual case
    where releases are built from a Git repository.  For example, if
    23 commits and some working-file changes have been made since
    release 2016g, the version number is now something like
    '2016g-23-g50556e3-dirty' instead of the misleading '2016g'.
    Official releases uses the same version number format as before,
    e.g., '2016g'.  To support the more-accurate version number, its
    specification has moved from a line in the Makefile to a new
    source file 'version'.

    The experimental distribution contains a file to2050.tzs that
    contains what should be the output of 'zdump -i -c 2050' on
    primary zones.  If this file is available, 'make check' now checks
    that zdump generates this output.

    'make check_web' now works on Fedora-like distributions.

  Changes to documentation and commentary

    tzfile.5 now documents the new restriction on POSIX TZ-like
    strings that is now implemented by zic.

    Comments now cite URLs for some 1917-1921 Russian DST decrees.
    (Thanks to Alexander Belopolsky.)

    tz-link.htm mentions JuliaTime (thanks to Curtis Vogt) and Time4J
    (thanks to Meno Hochschild) and ThreeTen-Extra, and its
    description of Java 8 has been brought up to date (thanks to
    Stephen Colebourne).  Its description of local time on Mars has
    been updated to match current practice, and URLs have been updated
    and some obsolete ones removed.

(From OE-Core rev: 19c365b23c3b835dcb5595aba598f35bf16a6d81)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agotzcode-native: update to 2016f
Armin Kuster [Thu, 7 Jul 2016 01:35:13 +0000 (18:35 -0700)]
tzcode-native: update to 2016f

changes done in data

(From OE-Core rev: 29377fa91a5f679909d582317c2b53d1f2e5da88)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agotzdata: update to 2016f
Armin Kuster [Thu, 7 Jul 2016 01:35:14 +0000 (18:35 -0700)]
tzdata: update to 2016f

 Changes affecting future time stamps

    The Egyptian government changed its mind on short notice, and
    Africa/Cairo will not introduce DST starting 2016-07-07 after all.
    (Thanks to Mina Samuel.)

    Asia/Novosibirsk switches from +06 to +07 on 2016-07-24 at 02:00.
    (Thanks to Stepan Golosunov.)

  Changes to past and future time stamps

    Asia/Novokuznetsk and Asia/Novosibirsk now use numeric time zone
    abbreviations instead of invented ones.

  Changes affecting past time stamps

    Europe/Minsk's 1992-03-29 spring-forward transition was at 02:00 not 00:00.
    (Thanks to Stepan Golosunov.)

(From OE-Core rev: dc80bf9b092a76f758d01474619cd9db46a1070d)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoopenssl: Security fix CVE-2016-6306
Armin Kuster [Sat, 24 Sep 2016 06:18:57 +0000 (23:18 -0700)]
openssl: Security fix CVE-2016-6306

affects openssl < 1.0.1i

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssl: Security fix CVE-2016-6304
Armin Kuster [Sat, 24 Sep 2016 06:16:30 +0000 (23:16 -0700)]
openssl: Security fix CVE-2016-6304

affects openssl < 1.0.1i

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssl: Security fix CVE-2016-6303
Armin Kuster [Sat, 24 Sep 2016 06:14:36 +0000 (23:14 -0700)]
openssl: Security fix CVE-2016-6303

affects openssl < 1.0.1i

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssl: Security fix CVE-2016-6302
Armin Kuster [Sat, 24 Sep 2016 06:13:04 +0000 (23:13 -0700)]
openssl: Security fix CVE-2016-6302

affects openssl < 1.0.1i

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssl: Security fix CVE-2016-2182
Armin Kuster [Sat, 24 Sep 2016 06:11:28 +0000 (23:11 -0700)]
openssl: Security fix CVE-2016-2182

affects openssl < 1.0.1i

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssl: Security fix CVE-2016-2181
Armin Kuster [Sat, 24 Sep 2016 06:09:29 +0000 (23:09 -0700)]
openssl: Security fix CVE-2016-2181

affects openssl < 1.0.1i

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssl: Security fix CVE-2016-2180
Armin Kuster [Sat, 24 Sep 2016 06:06:10 +0000 (23:06 -0700)]
openssl: Security fix CVE-2016-2180

affects openssl < 1.0.1i

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoinit-install.sh: fix disk_size
Robert Yang [Tue, 27 Sep 2016 14:15:36 +0000 (07:15 -0700)]
init-install.sh: fix disk_size

It mis-matched "SanDisk" or "Disk Flags" before, which caused unexpected
error.

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a68ac76c1b6ed4c1a2fbc944c5021c89fd26217f)
[YOCTO #10333]
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
8 years agoutil-linux: Security fix for CVE-2016-5011
Armin Kuster [Tue, 20 Sep 2016 04:51:14 +0000 (21:51 -0700)]
util-linux: Security fix for CVE-2016-5011

affects util-linux < 2.28.2

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoqemu: Secuirty fix for CVE-2016-5403
Armin Kuster [Tue, 20 Sep 2016 03:01:16 +0000 (20:01 -0700)]
qemu: Secuirty fix for CVE-2016-5403

affects qemu < 2.7.0-rc0

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoqemu: Security fix for CVE-2016-4002
Armin Kuster [Tue, 20 Sep 2016 02:56:19 +0000 (19:56 -0700)]
qemu: Security fix for CVE-2016-4002

affects qemu < 2.6.0

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoqemu: Security fix CVE-2016-6351
Armin Kuster [Tue, 20 Sep 2016 02:52:57 +0000 (19:52 -0700)]
qemu: Security fix CVE-2016-6351

affects qemu < 2.6.0

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoqemu: Security fix CVE-2016-4439
Armin Kuster [Tue, 20 Sep 2016 02:48:42 +0000 (19:48 -0700)]
qemu: Security fix CVE-2016-4439

affects qemu < 2.6.0

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoqemu: Security Fix CVE-2016-3712
Armin Kuster [Tue, 20 Sep 2016 01:12:42 +0000 (18:12 -0700)]
qemu: Security Fix CVE-2016-3712

affects qemu < 2.6.0

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoqemu: Security Fix CVE-2016-3710
Armin Kuster [Tue, 20 Sep 2016 01:02:55 +0000 (18:02 -0700)]
qemu: Security Fix CVE-2016-3710

affects Qemu < 2.6.0

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agowget: Security fix CVE-2016-4971
Armin Kuster [Sun, 18 Sep 2016 05:33:07 +0000 (22:33 -0700)]
wget: Security fix CVE-2016-4971

affects wget < 1.18.0

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssh: Security fix CVE-2015-8325
Armin Kuster [Sun, 18 Sep 2016 04:12:07 +0000 (21:12 -0700)]
openssh: Security fix CVE-2015-8325

openssh <  7.2p2

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssh: Security fix CVE-2016-5615
Armin Kuster [Sun, 18 Sep 2016 04:09:43 +0000 (21:09 -0700)]
openssh: Security fix CVE-2016-5615

openssh < 7.3

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssh: Security fix CVE-2016-6210
Armin Kuster [Sun, 18 Sep 2016 03:58:40 +0000 (20:58 -0700)]
openssh: Security fix CVE-2016-6210

affects openssh < 7.3

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agogit: Security fix CVE-2016-2315 CVE-2016-2324
Armin Kuster [Sat, 17 Sep 2016 22:22:39 +0000 (15:22 -0700)]
git: Security fix CVE-2016-2315 CVE-2016-2324

git versions < 2.5.5 & 2.7.4

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agobind: Security fix CVE-2016-2088
Armin Kuster [Sat, 17 Sep 2016 21:22:15 +0000 (14:22 -0700)]
bind: Security fix CVE-2016-2088

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agotiff: Security fix CVE-2016-5323
Yi Zhao [Wed, 10 Aug 2016 07:11:20 +0000 (15:11 +0800)]
tiff: Security fix CVE-2016-5323

CVE-2016-5323 libtiff: a maliciously crafted TIFF file could cause the
application to crash when using tiffcrop command

External References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5323
http://bugzilla.maptools.org/show_bug.cgi?id=2559

Patch from:
https://github.com/vadz/libtiff/commit/2f79856097f423eb33796a15fcf700d2ea41bf31

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 4ad1220e0a7f9ca9096860f4f9ae7017b36e29e4)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agotiff: Security fix CVE-2016-5321
Yi Zhao [Wed, 10 Aug 2016 07:11:19 +0000 (15:11 +0800)]
tiff: Security fix CVE-2016-5321

CVE-2016-5321 libtiff: a maliciously crafted TIFF file could cause the
application to crash when using tiffcrop command

External References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5321
http://bugzilla.maptools.org/show_bug.cgi?id=2558

Patch from:
https://github.com/vadz/libtiff/commit/d9783e4a1476b6787a51c5ae9e9b3156527589f0

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 4a167cfb6ad79bbe2a2ff7f7b43c4a162ca42a4d)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agotiff: Security fix CVE-2016-3186
Yi Zhao [Wed, 10 Aug 2016 07:11:18 +0000 (15:11 +0800)]
tiff: Security fix CVE-2016-3186

CVE-2016-3186 libtiff: buffer overflow in the readextension function in
gif2tiff.c allows remote attackers to cause a denial of service via a
crafted GIF file

External References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3186
https://bugzilla.redhat.com/show_bug.cgi?id=1319503

Patch from:
https://bugzilla.redhat.com/attachment.cgi?id=1144235&action=diff

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 3d818fc862b1d85252443fefa2222262542a10ae)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agolibpcre: Fix CVE-2016-3191
Ismo Puustinen [Wed, 4 May 2016 13:06:46 +0000 (16:06 +0300)]
libpcre: Fix CVE-2016-3191

Fix workspace overflow for (*ACCEPT) with deeply nested parentheses.

The patch is from libpcre version control at
http://vcs.pcre.org/pcre?view=revision&revision=1631 with the ChangeLog
part removed. Original author is Philip Hazel.

Signed-off-by: Ismo Puustinen <ismo.puustinen@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 386534f968f4da376ba7778b5d436bad4ce8355b)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoopenssl: Security fix CVE-2016-2178
Armin Kuster [Sat, 16 Jul 2016 23:04:12 +0000 (16:04 -0700)]
openssl: Security fix CVE-2016-2178

affects  openssl <=  1.0.2h
CVSS v2 Base Score: 2.1 LOW

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 5b3df0c5e8885ea34f66b41fcf209a9960fbbf5e)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoopenssl: Security fix CVE-2016-2177
Armin Kuster [Sat, 16 Jul 2016 23:04:11 +0000 (16:04 -0700)]
openssl: Security fix CVE-2016-2177

Affects openssl <= 1.0.2h
CVSS v2 Base Score: 7.5 HIGH

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 2848c7d3e454cbc84cba9183f23ccdf3e9200ec9)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoopenssl: add a patch to fix parallel builds
Ross Burton [Sat, 5 Mar 2016 00:12:02 +0000 (00:12 +0000)]
openssl: add a patch to fix parallel builds

Apply a patch taken from Gentoo to hopefully fix the remaining parallel make
races.

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 3d806d59a4c5e8ff35c7e7c5a3a6ef85e2b4b259)

Minor fixup to get patch to apply to jethro
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agocurl: security fix for CVE-2016-5421
Maxin B. John [Mon, 22 Aug 2016 08:39:33 +0000 (11:39 +0300)]
curl: security fix for CVE-2016-5421

Affected versions: libcurl 7.32.0 to and including 7.50.0

Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
8 years agocurl: security fix for CVE-2016-5420
Maxin B. John [Mon, 22 Aug 2016 08:39:32 +0000 (11:39 +0300)]
curl: security fix for CVE-2016-5420

Affected versions: libcurl 7.1 to and including 7.50.0

Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
8 years agocurl: security fix for CVE-2016-5419
Maxin B. John [Mon, 22 Aug 2016 08:39:31 +0000 (11:39 +0300)]
curl: security fix for CVE-2016-5419

Affected versions: libcurl 7.1 to and including 7.50.0

Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
8 years agoperl-ptest.inc: fix tar call to prevent objcopy failure
Enrico Jorns [Mon, 30 May 2016 13:04:05 +0000 (15:04 +0200)]
perl-ptest.inc: fix tar call to prevent objcopy failure

With tar version 1.29, the tar call used to copy the ptest files will
not work anymore. While the call did not match the man page (but worked)
before, anyway, the latest update of tar seems to have a more strict argument
handling.

With the current version of the tar call, the copying of files still
works with latest tar version, but the excludes will not be handled
properly anymore.
This results in having binaries compiled with host GCC in the package.
When doing the strip_and_split files in do_package() with the target
objcopy, bitbake will fail with this error:

  ERROR: objcopy failed with exit code 256 (cmd was [...])
  [...]
  File format not recognized

Thus, the current argument issues and required changes are:

 * Options must be placed _before_ the pathnames.

 * --exclude must be followd by a '=' in order to work properly

 * 'f' options is for providing an archive file, which is unnecessary in
   this case

Note that this could also be a candidate for backporting.

(From OE-Core master rev: 2e498879098f7d84610aed7961d92433083d9a02)

Signed-off-by: Enrico Jorns <ejo@pengutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
8 years agogcc: make sure header path is set correctly
Anuj Mittal [Tue, 14 Jun 2016 09:10:20 +0000 (17:10 +0800)]
gcc: make sure header path is set correctly

We're setting the native header paths in do_configure_prepend,
and don't need to set them again here.

This results in gcc-target not being able to locate the headers
and not being able to detect glibc version, which in turn
results in SSP support not getting detected even though it's available
in libc.

(From OE-Core master rev: 85630aa894278e7818c867179dc19ca2fbd994fc)

Signed-off-by: Anuj Mittal <anujx.mittal@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
8 years agotzdata: update to 2016e
Armin Kuster [Tue, 14 Jun 2016 21:50:22 +0000 (14:50 -0700)]
tzdata: update to 2016e

Changes affecting future time stamps

Africa/Cairo observes DST in 2016 from July 7 to the end of October.
Guess October 27 and 24:00 transitions. (Thanks to Steffen Thorsen.)
For future years, guess April's last Thursday to October's last
Thursday except for Ramadan.

Changes affecting past time stamps

Locations while uninhabited now use '-00', not 'zzz', as a
placeholder time zone abbreviation.  This is inspired by Internet
RFC 3339 and is more consistent with numeric time zone
abbreviations already used elsewhere.  The change affects several
arctic and antarctic locations, e.g., America/Cambridge_Bay before
1920 and Antarctica/Troll before 2005.

Asia/Baku's 1992-09-27 transition from +04 (DST) to +04 (non-DST) was
at 03:00, not 23:00 the previous day.  (Thanks to Michael Deckers.)

(From OE-Core master rev: ddcf128e76ed0678ce42416531f4ecb309c57439)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
8 years agotzcode: update to 2016e
Armin Kuster [Tue, 14 Jun 2016 21:50:21 +0000 (14:50 -0700)]
tzcode: update to 2016e

V2: typo in title (jet lagged)
Changes to code

zic now outputs a dummy transition at time 2**31 - 1 in zones
whose POSIX-style TZ strings contain a '<'.  This mostly works
around Qt bug 53071 <https://bugreports.qt.io/browse/QTBUG-53071>.
(Thanks to Zhanibek Adilbekov for reporting the Qt bug.)

Changes affecting documentation and commentary

tz-link.htm says why governments should give plenty of notice for
time zone or DST changes, and refers to Matt Johnson's blog post.
tz-link.htm mentions Tzdata for Elixir.  (Thanks to Matt Johnson.)

(From OE-Core master rev: 5f3340e5c966f4233e0cd4ec468b20a1fd5a7346)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
8 years agowic: fix path parsing, use last occurrence
George McCollister [Fri, 13 May 2016 14:22:53 +0000 (09:22 -0500)]
wic: fix path parsing, use last occurrence

If the path contains 'scripts' more than once the first occurrence will be
incorrectly used. Use rfind instead of find to find the last occurrence.

Signed-off-by: George McCollister <george.mccollister@gmail.com>
8 years agobluez5: move btmgmt to common READLINE section
Nicolas Dechesne [Wed, 25 May 2016 15:19:53 +0000 (17:19 +0200)]
bluez5: move btmgmt to common READLINE section

Upstream in 5.33 btmgmt was moved from experimental to common READLINE section,
in commit e4f0c5582f1fe3451d5588243adba9de1ed68b80, but this was never updated
in the recipe.

This is a backport from master branch, commit
28777e593d3dd3a5d0ee2effcdca6a971e2887f9.

Signed-off-by: Nicolas Dechesne <nicolas.dechesne@linaro.org>
8 years agolibxml2: Security fix for CVE-2016-4448
Armin Kuster [Sat, 9 Jul 2016 22:20:50 +0000 (15:20 -0700)]
libxml2: Security fix for CVE-2016-4448

Affects libxml2 < 2.9.4

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-4447
Armin Kuster [Sat, 9 Jul 2016 22:12:44 +0000 (15:12 -0700)]
libxml2: Security fix for CVE-2016-4447

Affects libxml2 < 2.9.4

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-3627
Armin Kuster [Sat, 9 Jul 2016 22:06:40 +0000 (15:06 -0700)]
libxml2: Security fix for CVE-2016-3627

Affects libxml2 < 2.9.4

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-1833
Armin Kuster [Sat, 9 Jul 2016 22:03:43 +0000 (15:03 -0700)]
libxml2: Security fix for CVE-2016-1833

Affects libxml2 < 2.9.4

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-1835
Armin Kuster [Sat, 9 Jul 2016 22:02:26 +0000 (15:02 -0700)]
libxml2: Security fix for CVE-2016-1835

Affects libxml2 < 2.9.4

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-1837
Armin Kuster [Sat, 9 Jul 2016 22:01:15 +0000 (15:01 -0700)]
libxml2: Security fix for CVE-2016-1837

Affects libxml2 < 2.9.4

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-4449
Armin Kuster [Sat, 9 Jul 2016 21:59:57 +0000 (14:59 -0700)]
libxml2: Security fix for CVE-2016-4449

Affects limbxml2 < 2.9.4

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-1836
Armin Kuster [Sat, 9 Jul 2016 21:58:22 +0000 (14:58 -0700)]
libxml2: Security fix for CVE-2016-1836

Affects libxml2 < 2.9.4

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-1839
Armin Kuster [Sat, 9 Jul 2016 21:57:08 +0000 (14:57 -0700)]
libxml2: Security fix for CVE-2016-1839

Affects libxml2 < 2.9.4

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-1838
Armin Kuster [Sat, 9 Jul 2016 21:55:49 +0000 (14:55 -0700)]
libxml2: Security fix for CVE-2016-1838

Affects libxml2 < 2.9.4

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-1840
Armin Kuster [Sat, 9 Jul 2016 21:54:21 +0000 (14:54 -0700)]
libxml2: Security fix for CVE-2016-1840

affects libxml2 < 2.9.4

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-4483.patch
Armin Kuster [Sat, 9 Jul 2016 21:31:00 +0000 (14:31 -0700)]
libxml2: Security fix for CVE-2016-4483.patch

affects libxml2 < 2.9.4

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-1834.patch
Armin Kuster [Sat, 9 Jul 2016 21:29:54 +0000 (14:29 -0700)]
libxml2: Security fix for CVE-2016-1834.patch

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-3705
Armin Kuster [Sat, 9 Jul 2016 21:28:45 +0000 (14:28 -0700)]
libxml2: Security fix for CVE-2016-3705

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-1762
Armin Kuster [Sat, 9 Jul 2016 21:27:44 +0000 (14:27 -0700)]
libxml2: Security fix for CVE-2016-1762

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoglibc: Security fix for CVE-2016-4429
Armin Kuster [Sat, 9 Jul 2016 18:56:49 +0000 (11:56 -0700)]
glibc: Security fix for CVE-2016-4429

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoglibc: Security Fix for CVE-2016-3706
Armin Kuster [Sat, 9 Jul 2016 18:55:29 +0000 (11:55 -0700)]
glibc: Security Fix for CVE-2016-3706

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agotoasterconf.json: exclude releases Toaster can't build
Elliot Smith [Fri, 3 Jun 2016 10:09:19 +0000 (11:09 +0100)]
toasterconf.json: exclude releases Toaster can't build

Due to changes in master to support Python 3, Toaster is no
longer able to build from master.

Remove references to master and set default release to jethro.

The dizzy release should also be removed, as Toaster jethro
is unable to build using this release.

Signed-off-by: Elliot Smith <elliot.smith@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agowic: insert local Python paths at front
Matt Madison [Sun, 6 Dec 2015 16:53:22 +0000 (08:53 -0800)]
wic: insert local Python paths at front

This follows how bitbake performs path insertion, and fixes a
failure to start wic on Ubuntu 15.10 with the distribution's
version of python-ply installed.

Signed-off-by: Matt Madison <matt@madison.systems>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agobuild-appliance-image: Update to jethro head revision
Richard Purdie [Mon, 23 May 2016 16:35:01 +0000 (17:35 +0100)]
build-appliance-image: Update to jethro head revision

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agobuild-appliance-image: Update to jethro head revision
Richard Purdie [Mon, 23 May 2016 16:25:06 +0000 (17:25 +0100)]
build-appliance-image: Update to jethro head revision

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agogdb: Backport patch to changes with AVX and MPX
Saul Wold [Thu, 19 May 2016 22:25:44 +0000 (15:25 -0700)]
gdb: Backport patch to changes with AVX and MPX

The current MPX target descriptions assume that MPX is always combined
with AVX, however that's not correct.  We can have machines with MPX
and without AVX; or machines with AVX and without MPX.

This patch adds new target descriptions for machines that support
both MPX and AVX, as duplicates of the existing MPX descriptions.

The following commit will remove AVX from the MPX-only descriptions.

This commit is backported from 7.12

Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agogcc: Security Fix CVE-2016-4490
Armin Kuster [Wed, 11 May 2016 00:41:21 +0000 (17:41 -0700)]
gcc: Security Fix CVE-2016-4490

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agogcc: Security fix CVE-2016-2226
Armin Kuster [Wed, 11 May 2016 00:32:55 +0000 (17:32 -0700)]
gcc: Security fix CVE-2016-2226

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agogcc: Security fix CVE-2016-4489
Armin Kuster [Wed, 11 May 2016 00:26:39 +0000 (17:26 -0700)]
gcc: Security fix CVE-2016-4489

Signed-off-by: Armin Kuster <akuster808@gmail.com>
9 years agogcc: Security fix CVE-2016-4488
Armin Kuster [Thu, 5 May 2016 22:12:58 +0000 (15:12 -0700)]
gcc: Security fix CVE-2016-4488

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agoopenssl: prevent ABI break from earlier jethro releases
Joshua Lock [Fri, 13 May 2016 23:49:58 +0000 (16:49 -0700)]
openssl: prevent ABI break from earlier jethro releases

The backported upgrade to 1.0.2h included an updated GNU LD
version-script which results in an ABI change. In order to try and
respect ABI for existing binaries built against fido this commit
partially reverts the version-script to maintain the existing ABI
and instead only add the new symbols required by 1.0.2h.

Suggested-by: Martin Jansa <martin.jansa@gmail.com>
(From OE-Core rev: 480db6be99f9a53d8657b31b846f0079ee1a124f)

Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agoopenssh: Security Fix CVE-2016-3115
Armin Kuster [Wed, 27 Apr 2016 22:20:00 +0000 (15:20 -0700)]
openssh: Security Fix CVE-2016-3115

opehssh <= 7.2

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agobusybox: Security fix CVE-2016-2147
Armin Kuster [Wed, 27 Apr 2016 20:29:51 +0000 (13:29 -0700)]
busybox: Security fix CVE-2016-2147

busybox <= 1.24.2

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agobusybox: Security Fix CVE-2016-2148
Armin Kuster [Wed, 27 Apr 2016 20:28:01 +0000 (13:28 -0700)]
busybox: Security Fix CVE-2016-2148

busybox <= 1.24.2

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agolibtiff: Security fix CVE-2015-8664 and 8683
Armin Kuster [Tue, 26 Apr 2016 20:19:44 +0000 (13:19 -0700)]
libtiff: Security fix CVE-2015-8664 and 8683

CVE-2015-8665
CVE-2015-8683

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agoopenssl: 1.0.2d -> 1.0.2h (mainly for CVEs)
Robert Yang [Wed, 11 May 2016 07:43:28 +0000 (00:43 -0700)]
openssl: 1.0.2d -> 1.0.2h (mainly for CVEs)

* CVEs:
  - CVE-2016-0705
  - CVE-2016-0798
  - CVE-2016-0797
  - CVE-2016-0799
  - CVE-2016-0702
  - CVE-2016-0703
  - CVE-2016-0704
  - CVE-2016-2105
  - CVE-2016-2106
  - CVE-2016-2109
  - CVE-2016-2176

* The LICENSE's checksum is changed because of date changes (2011 ->
  2016), the contents are the same.

* Remove backport patches
  - 0001-Add-test-for-CVE-2015-3194.patch
  - CVE-2015-3193-bn-asm-x86_64-mont5.pl-fix-carry-propagating-bug-CVE.patch
  - CVE-2015-3194-1-Add-PSS-parameter-check.patch
  - CVE-2015-3195-Fix-leak-with-ASN.1-combine.patch
  - CVE-2015-3197.patch
  - CVE-2016-0701_1.patch
  - CVE-2016-0701_2.patch
  - CVE-2016-0800.patch
  - CVE-2016-0800_2.patch
  - CVE-2016-0800_3.patch

* Update crypto_use_bigint_in_x86-64_perl.patch

* Add version-script.patch and update block_diginotar.patch (From master branch)

* Update openssl-avoid-NULL-pointer-dereference-in-EVP_DigestInit_ex.patch
  (From Armin)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agoRevert "kernel/kernel-arch: Explicitly mapping between, i386/x86_64 and x86 for kerne...
Tom Zanussi [Tue, 10 May 2016 21:50:05 +0000 (16:50 -0500)]
Revert "kernel/kernel-arch: Explicitly mapping between, i386/x86_64 and x86 for kernel ARCH"

This reverts commit a6f52930a68d8462e23486d51cdda715072dd752.

In addition to also causing the problem in [YOCTO #9579], this commit
was reverted in krogoth and master but wasn't reverted in jethro but
should be.  The original revert message was:

This reverts commit 8d310b24927d0f348fb431895f0583733db2aad0.

That commit completely breaks KBUILD_DEFCONFIG because it relies on
$ARCH to match between the target OE arch and the kernel subdirectory
containing the defconfigs. In the kernel all defconfigs for everything
x86-based (including x86_64) is stored in dir arch/x86/configs/

kernel-yocto.bbclass correctly searches for all the defconfigs inside
${S}/arch/${ARCH}/configs/${KBUILD_DEFCONFIG}

Commit 8d310b249 makes it search in wrong places and _only_ if you
define TARGET_ARCH = "athlon" will it search x86 which is nonsensical.

The commit further adds an if clause to hack the mungled kernel arches
back to their original values (ugh) in do_shared_workdir which is run
after do compile, but of course the build breaks before that in
do_kernel_metadata because of the KBUILD_DEFCONFIG mentioned above (so
that hack is useless).

Please fix that corner case bug in another way which does not completely
screw up the kernel arch mapping & defconfig logic. If 64bit configs are
generated in the kernel for 32bit machines because the host is asked,
then it it a bug in the kernel, it is of no use to hack around it in OE.

(From OE-Core rev: bc02a478a5d4a5de7b3943ed809d5c22711f5b1f)

Signed-off-by: Ioan-Adrian Ratiu <adrian.ratiu@ni.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Tom Zanussi <tom.zanussi@linux.intel.com>
9 years agoglew: Correct version in autotooling patches
Martyn Welch [Wed, 27 Apr 2016 11:25:00 +0000 (12:25 +0100)]
glew: Correct version in autotooling patches

The additional autotooling patched into glew claims the version is 1.9.0
whilst we are building 1.12.0. The version in the autotooling is used to
set the version number in the pkgconfig file, this results in the
configuration of packages which depend on glew > 1.9.0 failing.

This patch updates the version number used in the patches to match that of
the version being built.

Signed-off-by: Martyn Welch <martyn.welch@collabora.co.uk>
9 years agogdb: fix QA warning (uClibc)
André Draszik [Fri, 29 Apr 2016 10:52:38 +0000 (11:52 +0100)]
gdb: fix QA warning (uClibc)

WARNING: QA Issue: gdb rdepends on libiconv, but it isn't a build dependency? [build-deps]

We already have virtual/libiconv which is set appropriately
in all environments, so let's use it to fix the issue.

Signed-off-by: André Draszik <adraszik@tycoint.com>
9 years agobinutils: backport bug fix to the 2.25 branch for jethro
Tristan Van Berkom [Wed, 27 Apr 2016 21:39:40 +0000 (17:39 -0400)]
binutils: backport bug fix to the 2.25 branch for jethro

We fail to build webkit on aarch64 due to this binutils bug:

   https://sourceware.org/bugzilla/show_bug.cgi?id=19353

Applying patch which fixes this, stripped out changelog entry
from patch to make it apply without error.

9 years agoglibc: Fix CVE-2015-8778
Yuanjie Huang [Wed, 27 Apr 2016 09:32:55 +0000 (02:32 -0700)]
glibc: Fix CVE-2015-8778

CVE: CVE-2015-8778

Improve check against integer wraparound in hcreate_r [BZ #18240]

This is an integer overflow in hcreate and hcreate_r which can result in
an out-of-bound memory access.  This could lead to application crashes
or, potentially, arbitrary code execution.

Upstream-Status: Backport [2.23]
(cherry-picked from commit bae7c7c74bd228c8)

Signed-off-by: Yuanjie Huang <yuanjie.huang@windriver.com>
9 years agoboot-directdisk.bbclass: remove HDDIMG before create
Robert Yang [Mon, 25 Apr 2016 01:10:38 +0000 (18:10 -0700)]
boot-directdisk.bbclass: remove HDDIMG before create

Fixed when rebuild:
mkdosfs: file /path/to/hdd.image already exists

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry-pick from 9abcd309c098558360cde2bff65be840ead25f83)
Signed-off-by: Tim Kilbourn <tkilbourn@gmail.com>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agoopkg: backport fix for double remove of packges
Stefan Agner [Mon, 25 Apr 2016 01:10:37 +0000 (18:10 -0700)]
opkg: backport fix for double remove of packges

Backport the fix 7885da3974 ("pkg_get_provider_replacees: do not
add installed pkg to replacee list"). This avoids opkg trying to
remove a package twice e.g. when upgrading.

Suggested-by: Alejandro del Castillo <alejandro.delcastillo@ni.com>
Signed-off-by: Stefan Agner <stefan.agner@toradex.com>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agobind: CVE-2016-1285 CVE-2016-1286
Sona Sarmadi [Mon, 25 Apr 2016 01:10:36 +0000 (18:10 -0700)]
bind: CVE-2016-1285 CVE-2016-1286

CVE-2016-1285 bind: malformed packet sent to rndc can trigger assertion failure
CVE-2016-1286 bind: malformed signature records for DNAME records can
trigger assertion failure

[YOCTO #9400]

External References:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1285
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1286
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1285
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1286

References to the Upstream commits and Security Advisories:

CVE-2016-1285: https://kb.isc.org/article/AA-01352
https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=patch;
h=e7e15d1302b26a96fa0a5307d6f2cb0d8ad4ea63

CVE-2016-1286: https://kb.isc.org/article/AA-01353
https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=patch;
h=456e1eadd2a3a2fb9617e60d4db90ef4ba7c6ba3

https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=patch;
h=499952eb459c9a41d2092f1d98899c131f9103b2

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agolicense.bbclass: fix warnings when run in unprivileged "container" env
Bjørn Forsman [Mon, 25 Apr 2016 01:10:35 +0000 (18:10 -0700)]
license.bbclass: fix warnings when run in unprivileged "container" env

An unprivileged "container" environment like this[1] doesn't have root
account (uid 0) which causes tons of "Invalid argument" warnings:

  $ bitbake ...
  ...
  WARNING: Could not copy license file [src] to [dest]: [Errno 22] Invalid argument: '[src]'
  WARNING: Could not copy license file [src] to [dest]: [Errno 22] Invalid argument: '[src]'
  WARNING: Could not copy license file [src] to [dest]: [Errno 22] Invalid argument: '[src]'
  ...

Fix it by handling EINVAL similar to existing handling of EPERM (which
was added for when not running under pseudo).

[1]: The real environemnt is buildFHSUserEnv from NixOS/nixpkgs, but a
  demonstration of the issue can be done like this:

    $ touch f
    $ unshare --user --mount chown 0:0 f
    chown: changing ownership of ‘f’: Invalid argument

(From OE-Core master rev: d00b2250a6afebd7d1373c04b4006290f0cd4043)

Signed-off-by: Bjørn Forsman <bjorn.forsman@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agotzdata: update to 2016d
Armin Kuster [Mon, 25 Apr 2016 01:10:34 +0000 (18:10 -0700)]
tzdata: update to 2016d

Changes affecting future time stamps

America/Caracas switches from -0430 to -04 on 2016-05-01 at 02:30.
(Thanks to Alexander Krivenyshev for the heads-up.)

Asia/Magadan switches from +10 to +11 on 2016-04-24 at 02:00.
(Thanks to Alexander Krivenyshev and Matt Johnson.)

New zone Asia/Tomsk, split off from Asia/Novosibirsk. It covers
Tomsk Oblast, Russia, which switches from +06 to +07 on 2016-05-29
at 02:00.  (Thanks to Stepan Golosunov.)

Changes affecting past time stamps

New zone Europe/Kirov, split off from Europe/Volgograd.  It covers
Kirov Oblast, Russia, which switched from +04/+05 to +03/+04 on
1989-03-26 at 02:00, roughly a year after Europe/Volgograd made
the same change.  (Thanks to Stepan Golosunov.)

Russia and nearby locations had daylight-saving transitions on
1992-03-29 at 02:00 and 1992-09-27 at 03:00, instead of on
1992-03-28 at 23:00 and 1992-09-26 at 23:00.  (Thanks to Stepan
Golosunov.)

Many corrections to historical time in Kazakhstan from 1991
through 2005.  (Thanks to Stepan Golosunov.)  Replace Kazakhstan's
invented time zone abbreviations with numeric abbreviations.

(From OE-Core master rev: 10194ca3d8c2f4d8648a685c5c239a33d944b6fe)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agotzcode: update to 2016d
Armin Kuster [Mon, 25 Apr 2016 01:10:33 +0000 (18:10 -0700)]
tzcode: update to 2016d

they keep the versions in-sync. changes are all in data.

Changes affecting future time stamps

America/Caracas switches from -0430 to -04 on 2016-05-01 at 02:30.
(Thanks to Alexander Krivenyshev for the heads-up.)

Asia/Magadan switches from +10 to +11 on 2016-04-24 at 02:00.
(Thanks to Alexander Krivenyshev and Matt Johnson.)

New zone Asia/Tomsk, split off from Asia/Novosibirsk. It covers
Tomsk Oblast, Russia, which switches from +06 to +07 on 2016-05-29
at 02:00.  (Thanks to Stepan Golosunov.)

Changes affecting past time stamps

New zone Europe/Kirov, split off from Europe/Volgograd.  It covers
Kirov Oblast, Russia, which switched from +04/+05 to +03/+04 on
1989-03-26 at 02:00, roughly a year after Europe/Volgograd made
the same change.  (Thanks to Stepan Golosunov.)

Russia and nearby locations had daylight-saving transitions on
1992-03-29 at 02:00 and 1992-09-27 at 03:00, instead of on
1992-03-28 at 23:00 and 1992-09-26 at 23:00.  (Thanks to Stepan
Golosunov.)

Many corrections to historical time in Kazakhstan from 1991
through 2005.  (Thanks to Stepan Golosunov.)  Replace Kazakhstan's
invented time zone abbreviations with numeric abbreviations.

(From OE-Core master rev: db8223e4dd2e513a656aedfae217d94e053c2366)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agotzcode: update to 2016c
Armin Kuster [Thu, 24 Mar 2016 01:21:50 +0000 (18:21 -0700)]
tzcode: update to 2016c

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agotzdata: update to 2016c
Armin Kuster [Thu, 24 Mar 2016 01:21:51 +0000 (18:21 -0700)]
tzdata: update to 2016c

The 2016c release of the tz code and data is available. Its most urgent change is for Asia/Baku, where the update takes effect this weekend.

This release reflects the following changes, which were either circulated on the tz mailing list or are relatively minor technical or administrative changes:

Changes affecting future time stamps

Azerbaijan no longer observes DST.  (Thanks to Steffen Thorsen.)

Chile reverts from permanent to seasonal DST.  (Thanks to Juan
Correa for the heads-up, and to Tim Parenti for corrections.)
Guess that future transitions are August's and May's second
Saturdays at 24:00 mainland time.  Also, call the period from
2014-09-07 through 2016-05-14 daylight saving time instead of
standard time, as that seems more appropriate now.

Changes affecting past time stamps

Europe/Kaliningrad and Europe/Vilnius changed from +03/+04 to
+02/+03 on 1989-03-26, not 1991-03-31.  Europe/Volgograd changed
from +04/+05 to +03/+04 on 1988-03-27, not 1989-03-26.
(Thanks to Stepan Golosunov.)

Changes to commentary
Several updates and URLs for historical and proposed Russian changes.
(Thanks to Stepan Golosunov, Matt Johnson, and Alexander Krivenyshev.)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agotzcode: update to 2016b
Armin Kuster [Fri, 18 Mar 2016 21:43:17 +0000 (14:43 -0700)]
tzcode: update to 2016b

change SRC_URI http seems more reliable

Changes to code

     tzselect's diagnostics and checking, and checktab.awk's checking,
     have been improved.  (Thanks to J William Piggott.)

     tzcode now builds under MinGW.  (Thanks to Ian Abbott and Esben Haabendal.)

     tzselect now tests Julian-date TZ settings more accurately.
     (Thanks to J William Piggott.)

Changes to commentary

     Comments in zone tables have been improved.  (Thanks to J William Piggott.)

     tzselect again limits its menu comments so that menus fit on a
     24x80 alphanumeric display.

     A new web page tz-how-to.html.  (Thanks to Bill Seymour.)

     In the Theory file, the description of possible time zone abbreviations in
     tzdata has been cleaned up, as the old description was unclear and
     inconsistent.  (Thanks to Alain Mouette for reporting the problem.)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agotzdata: update to 2016b
Armin Kuster [Fri, 18 Mar 2016 21:43:18 +0000 (14:43 -0700)]
tzdata: update to 2016b

updated SRC_URI to http as it seems more stable.

Changes affecting future time stamps

     New zones Europe/Astrakhan and Europe/Ulyanovsk for Astrakhan and
     Ulyanovsk Oblasts, Russia, both of which will switch from +03 to +04 on
     2016-03-27 at 02:00 local time.  They need distinct zones since their
     post-1970 histories disagree.  New zone Asia/Barnaul for Altai Krai and
     Altai Republic, Russia, which will switch from +06 to +07 on the same date
     and local time.  Also, Asia/Sakhalin moves from +10 to +11 on 2016-03-27
     at 02:00.  (Thanks to Alexander Krivenyshev for the heads-up, and to
     Matt Johnson and Stepan Golosunov for followup.)

     As a trial of a new system that needs less information to be made up,
     the new zones use numeric time zone abbreviations like "+04"
     instead of invented abbreviations like "ASTT".

     Haiti will not observe DST in 2016.  (Thanks to Jean Antoine via
     Steffen Thorsen.)

     Palestine's spring-forward transition on 2016-03-26 is at 01:00, not 00:00.
     (Thanks to Hannah Kreitem.) Guess future transitions will be March's last
     Saturday at 01:00, not March's last Friday at 24:00.

Changes affecting past time stamps

     Europe/Chisinau observed DST during 1990, and switched from +04 to
     +03 at 1990-05-06 02:00, instead of switching from +03 to +02.
     (Thanks to Stepan Golosunov.)

     1991 abbreviations in Europe/Samara should be SAMT/SAMST, not
     KUYT/KUYST.  (Thanks to Stepan Golosunov.)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agolttng-tools: fix regression tests hang
Awais Belal [Mon, 11 Apr 2016 07:29:17 +0000 (00:29 -0700)]
lttng-tools: fix regression tests hang

Some of the lttng fast_regression ptests have race
conditions which end up in a deadlock so the test
case never returns and the only way around is to
kill the process.
This is fixed by picking up relevant patches from
lttng-tools mainstream that fix up the behavior
of these tests.

Signed-off-by: Awais Belal <awais_belal@mentor.com>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>