]> code.ossystems Code Review - openembedded-core.git/log
openembedded-core.git
7 years agowpa_supplicant: fix WPA2 key replay security bug jethro
Ross Burton [Tue, 17 Oct 2017 11:17:29 +0000 (12:17 +0100)]
wpa_supplicant: fix WPA2 key replay security bug

WPA2 is vulnerable to replay attacks which result in unauthenticated users
having access to the network.

* CVE-2017-13077: reinstallation of the pairwise key in the Four-way handshake

* CVE-2017-13078: reinstallation of the group key in the Four-way handshake

* CVE-2017-13079: reinstallation of the integrity group key in the Four-way
handshake

* CVE-2017-13080: reinstallation of the group key in the Group Key handshake

* CVE-2017-13081: reinstallation of the integrity group key in the Group Key
handshake

* CVE-2017-13082: accepting a retransmitted Fast BSS Transition Reassociation
Request and reinstalling the pairwise key while processing it

* CVE-2017-13086: reinstallation of the Tunneled Direct-Link Setup (TDLS)
PeerKey (TPK) key in the TDLS handshake

* CVE-2017-13087: reinstallation of the group key (GTK) when processing a
Wireless Network Management (WNM) Sleep Mode Response frame

* CVE-2017-13088: reinstallation of the integrity group key (IGTK) when
processing a Wireless Network Management (WNM) Sleep Mode Response frame

Backport patches from upstream to resolve these CVEs.

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
8 years agobuild-appliance-image: Update to jethro head revision
Richard Purdie [Tue, 6 Dec 2016 22:48:36 +0000 (22:48 +0000)]
build-appliance-image: Update to jethro head revision

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
8 years agotzdata: update to 2016i
Armin Kuster [Fri, 4 Nov 2016 05:53:28 +0000 (22:53 -0700)]
tzdata: update to 2016i

  Briefly: Cyprus split into two time zones on 2016-10-30, and Tonga
  reintroduces DST on 2016-11-06.

  Changes to future time stamps

    Pacific/Tongatapu begins DST on 2016-11-06 at 02:00, ending on
    2017-01-15 at 03:00.  Assume future observances in Tonga will be
    from the first Sunday in November through the third Sunday in
    January, like Fiji.  (Thanks to Pulu ʻAnau.)  Switch to numeric
    time zone abbreviations for this zone.

  Changes to past and future time stamps

    Northern Cyprus is now +03 year round, causing a split in Cyprus
    time zones starting 2016-10-30 at 04:00.  This creates a zone
    Asia/Famagusta.  (Thanks to Even Scharning and Matt Johnson.)

    Antarctica/Casey switched from +08 to +11 on 2016-10-22.
    (Thanks to Steffen Thorsen.)

  Changes to past time stamps

    Several corrections were made for pre-1975 time stamps in Italy.
    These affect Europe/Malta, Europe/Rome, Europe/San_Marino, and
    Europe/Vatican.

    First, the 1893-11-01 00:00 transition in Italy used the new UT
    offset (+01), not the old (+00:49:56).  (Thanks to Michael
    Deckers.)

    Second, rules for daylight saving in Italy were changed to agree
    with Italy's National Institute of Metrological Research (INRiM)
    except for 1944, as follows (thanks to Pierpaolo Bernardi, Brian
    Inglis, and Michael Deckers):

      The 1916-06-03 transition was at 24:00, not 00:00.

      The 1916-10-01, 1919-10-05, and 1920-09-19 transitions were at
      00:00, not 01:00.

      The 1917-09-30 and 1918-10-06 transitions were at 24:00, not
      01:00.

      The 1944-09-17 transition was at 03:00, not 01:00.  This
      particular change is taken from Italian law as INRiM's table,
      (which says 02:00) appears to have a typo here.  Also, keep the
      1944-04-03 transition for Europe/Rome, as Rome was controlled by
      Germany then.

      The 1967-1970 and 1972-1974 fallback transitions were at 01:00,
      not 00:00.

(From OE-Core rev: daf95f7fd9f7ab65685d7b764d8e50df8d00d308)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agotzcode: update to 2016i
Armin Kuster [Fri, 4 Nov 2016 05:53:27 +0000 (22:53 -0700)]
tzcode: update to 2016i

Changes to code

  The code should now be buildable on AmigaOS merely by setting the
  appropriate Makefile variables.  (From a patch by Carsten Larsen.)

(From OE-Core rev: d2b8c4ee535684f5d874082a7f76efbda1907ea5)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agotzdata: Update to 2016h
Armin Kuster [Mon, 24 Oct 2016 03:00:16 +0000 (20:00 -0700)]
tzdata: Update to 2016h

Changes to future time stamps

    Asia/Gaza and Asia/Hebron end DST on 2016-10-29 at 01:00, not
    2016-10-21 at 00:00.  (Thanks to Sharef Mustafa.)  Predict that
    future fall transitions will be on the last Saturday of October
    at 01:00, which is consistent with predicted spring transitions
    on the last Saturday of March.  (Thanks to Tim Parenti.)

Changes to past time stamps

    In Turkey, transitions in 1986-1990 were at 01:00 standard time
    not at 02:00, and the spring 1994 transition was on March 20, not
    March 27.  (Thanks to Kıvanç Yazan.)

Changes to past and future time zone abbreviations

    Asia/Colombo now uses numeric time zone abbreviations like "+0530"
    instead of alphabetic ones like "IST" and "LKT".  Various
    English-language sources use "IST", "LKT" and "SLST", with no
    working consensus.  (Usage of "SLST" mentioned by Sadika
    Sumanapala.)

(From OE-Core rev: ff11ca44fec8e4b2aa523e032bd967e3ab8339a8)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agotzcode-native: update to 2016h
Armin Kuster [Mon, 24 Oct 2016 03:00:15 +0000 (20:00 -0700)]
tzcode-native: update to 2016h

Changes to code

zic no longer mishandles relativizing file names when creating
symbolic links like /etc/localtime, when these symbolic links
are outside the usual directory hierarchy.  This fixes a bug
introduced in 2016g.  (Problem reported by Andreas Stieger.)

(From OE-Core rev: 9c5de646e01a83219be74e99dcf7c1e56ba38b53)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agopython-2.7: Security fix CVE-2016-1000110
Armin Kuster [Sun, 6 Nov 2016 18:54:52 +0000 (10:54 -0800)]
python-2.7: Security fix CVE-2016-1000110

affects python-2.7 < 2.7.12

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agopython-2.7: Security fix CVE-2016-5699
Armin Kuster [Sun, 6 Nov 2016 18:39:35 +0000 (10:39 -0800)]
python-2.7: Security fix CVE-2016-5699

affect python-2.7 < 2.7.10

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agopython-2.7: Security fix CVE-2016-5636
Armin Kuster [Sun, 6 Nov 2016 18:36:07 +0000 (10:36 -0800)]
python-2.7: Security fix CVE-2016-5636

Affects python-2.7 < 2.7.12

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agopython-2.7: Security fix CVE-2016-0772
Armin Kuster [Sun, 6 Nov 2016 18:27:08 +0000 (10:27 -0800)]
python-2.7: Security fix CVE-2016-0772

Affects python < 2.7.12

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssl: Security fix CVE-2016-8610
Armin Kuster [Sun, 6 Nov 2016 15:33:27 +0000 (07:33 -0800)]
openssl: Security fix CVE-2016-8610

affects openssl < 1.0.2i

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssl: Security fix CVE-2016-2179
Armin Kuster [Sun, 6 Nov 2016 14:54:25 +0000 (06:54 -0800)]
openssl: Security fix CVE-2016-2179

affects openssl < 1.0.2i

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agobind: Security fix CVE-2016-2776
Armin Kuster [Mon, 3 Oct 2016 00:52:11 +0000 (17:52 -0700)]
bind: Security fix CVE-2016-2776

affect bind < 9.10.4-p3

Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agobind: Security fix CVE-2016-2775
Armin Kuster [Mon, 3 Oct 2016 00:49:24 +0000 (17:49 -0700)]
bind: Security fix CVE-2016-2775

affect bind < 9.10.4-p2

Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agognutils: Security fix CVE-2016-7444
Armin Kuster [Mon, 3 Oct 2016 00:11:14 +0000 (17:11 -0700)]
gnutils: Security fix CVE-2016-7444

affects gnutls < 3.3.24

Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agognupg: fix find-version for beta checking
Wenzong Fan [Wed, 28 Oct 2015 05:53:37 +0000 (01:53 -0400)]
gnupg: fix find-version for beta checking

find-version always assumes that gnupg is beta if autogen.sh is run
out of git-repo. This doesn't work for users whom just take release
tarball and re-run autoconf in their local build dir.

This fixes runtime issue:

  $gpg --list-sigs
  gpg: NOTE: THIS IS A DEVELOPMENT VERSION!
  gpg: It is only intended for test purposes and should NOT be
  gpg: used in a production environment or with production keys!

Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
8 years agoperl: fix CVE-2016-1238
Mingli Yu [Mon, 26 Sep 2016 06:00:42 +0000 (14:00 +0800)]
perl: fix CVE-2016-1238

Backport patch to fix CVE-2016-1238 from perl upstream:
http://perl5.git.perl.org/perl.git/commitdiff/cee96d52c39b1e7b36e1c62d38bcd8d86e9a41ab

(From OE-Core rev: 7d06ffcbcd0c71dc6dc9efde02bf0cd8d7c7d7e3)

Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fixed up to apply to 5.20.0
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoperl: fix CVE-2015-8607
Mingli Yu [Wed, 21 Sep 2016 09:47:32 +0000 (17:47 +0800)]
perl: fix CVE-2015-8607

Backport patch to fix CVE-2015-8607 from perl upstream:
http://perl5.git.perl.org/perl.git/commitdiff/0b6f93036de171c12ba95d415e264d9cf7f4e1fd

(From OE-Core rev: e2289647ace9ef96e6a7e4aae201fd9149e56678)

Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
fixed up to apply to 5.22.0
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoperl: fix CVE-2016-6185
Mingli Yu [Wed, 21 Sep 2016 09:47:31 +0000 (17:47 +0800)]
perl: fix CVE-2016-6185

Backport patch to fix CVE-2016-6185 from perl upstream:
http://perl5.git.perl.org/perl.git/commitdiff/08e3451d7

(From OE-Core rev: 81e550d0c23c9842b85207cdfa73bbe9102e01fb)

Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
fixed up to apply against 5.22.0
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoperl: fix CVE-2016-2381
Kai Kang [Thu, 14 Jul 2016 08:53:08 +0000 (16:53 +0800)]
perl: fix CVE-2016-2381

Backport patch to fix CVE-2016-2381 from perl upstream:

http://perl5.git.perl.org/perl.git/commitdiff/ae37b791a73a9e78dedb89fb2429d2628cf58076

(From OE-Core rev: 07ca8a0131f43e9cc2f720e1cdbcb7ba7c074886)

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fixed up to apply again 5.22.0
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agotzdata: update to 2016g
Armin Kuster [Wed, 28 Sep 2016 23:42:35 +0000 (16:42 -0700)]
tzdata: update to 2016g

LICENSE md5sum changed do to rewording some text not released to the license.
see https://github.com/eggert/tz/commit/8c143a2b65fdfd43a7911be6fdb700c9c4553f58

  Changes to future time stamps

    Turkey switched from EET/EEST (+02/+03) to permanent +03,
    effective 2016-09-07.  (Thanks to Burak AYDIN.)  Use "+03" rather
    than an invented abbreviation for the new time.

    New leap second 2016-12-31 23:59:60 UTC as per IERS Bulletin C 52.
    (Thanks to Tim Parenti.)

  Changes to past time stamps

    For America/Los_Angeles, spring-forward transition times have been
    corrected from 02:00 to 02:01 in 1948, and from 02:00 to 01:00 in
    1950-1966.

    For zones using Soviet time on 1919-07-01, transitions to UT-based
    time were at 00:00 UT, not at 02:00 local time.  The affected
    zones are Europe/Kirov, Europe/Moscow, Europe/Samara, and
    Europe/Ulyanovsk.  (Thanks to Alexander Belopolsky.)

  Changes to past and future time zone abbreviations

    The Factory zone now uses the time zone abbreviation -00 instead
    of a long English-language string, as -00 is now the normal way to
    represent an undefined time zone.

    Several zones in Antarctica and the former Soviet Union, along
    with zones intended for ships at sea that cannot use POSIX TZ
    strings, now use numeric time zone abbreviations instead of
    invented or obsolete alphanumeric abbreviations.  The affected
    zones are Antarctica/Casey, Antarctica/Davis,
    Antarctica/DumontDUrville, Antarctica/Mawson, Antarctica/Rothera,
    Antarctica/Syowa, Antarctica/Troll, Antarctica/Vostok,
    Asia/Anadyr, Asia/Ashgabat, Asia/Baku, Asia/Bishkek, Asia/Chita,
    Asia/Dushanbe, Asia/Irkutsk, Asia/Kamchatka, Asia/Khandyga,
    Asia/Krasnoyarsk, Asia/Magadan, Asia/Omsk, Asia/Sakhalin,
    Asia/Samarkand, Asia/Srednekolymsk, Asia/Tashkent, Asia/Tbilisi,
    Asia/Ust-Nera, Asia/Vladivostok, Asia/Yakutsk, Asia/Yekaterinburg,
    Asia/Yerevan, Etc/GMT-14, Etc/GMT-13, Etc/GMT-12, Etc/GMT-11,
    Etc/GMT-10, Etc/GMT-9, Etc/GMT-8, Etc/GMT-7, Etc/GMT-6, Etc/GMT-5,
    Etc/GMT-4, Etc/GMT-3, Etc/GMT-2, Etc/GMT-1, Etc/GMT+1, Etc/GMT+2,
    Etc/GMT+3, Etc/GMT+4, Etc/GMT+5, Etc/GMT+6, Etc/GMT+7, Etc/GMT+8,
    Etc/GMT+9, Etc/GMT+10, Etc/GMT+11, Etc/GMT+12, Europe/Kaliningrad,
    Europe/Minsk, Europe/Samara, Europe/Volgograd, and
    Indian/Kerguelen.  For Europe/Moscow the invented abbreviation MSM
    was replaced by +05, whereas MSK and MSD were kept as they are not
    our invention and are widely used.

  Changes to zone names

    Rename Asia/Rangoon to Asia/Yangon, with a backward compatibility link.
    (Thanks to David Massoud.)

(From OE-Core rev: d1341aeda6d9fa5d7f13afabadae60a6fc295b87)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agotzcode-native: Update to 2016g
Armin Kuster [Wed, 28 Sep 2016 23:42:34 +0000 (16:42 -0700)]
tzcode-native: Update to 2016g

LICENSE file checksum changed do to a verbage change.

  Changes to code

    zic no longer generates binary files containing POSIX TZ-like
    strings that disagree with the local time type after the last
    explicit transition in the data.  This fixes a bug with
    Africa/Casablanca and Africa/El_Aaiun in some year-2037 time
    stamps on the reference platform.  (Thanks to Alexander Belopolsky
    for reporting the bug and suggesting a way forward.)

    If the installed localtime and/or posixrules files are symbolic
    links, zic now keeps them symbolic links when updating them, for
    compatibility with platforms like OpenSUSE where other programs
    configure these files as symlinks.

    zic now avoids hard linking to symbolic links, avoids some
    unnecessary mkdir and stat system calls, and uses shorter file
    names internally.

    zdump has a new -i option to generate transitions in a
    more-compact but still human-readable format.  This option is
    experimental, and the output format may change in future versions.
    (Thanks to Jon Skeet for suggesting that an option was needed,
    and thanks to Tim Parenti and Chris Rovick for further comments.)

  Changes to build procedure

    An experimental distribution format is available, in addition
    to the traditional format which will continue to be distributed.
    The new format is a tarball tzdb-VERSION.tar.lz with signature
    file tzdb-VERSION.tar.lz.asc.  It unpacks to a top-level directory
    tzdb-VERSION containing the code and data of the traditional
    two-tarball format, along with extra data that may be useful.
    (Thanks to Antonio Diaz Diaz, Oscar van Vlijmen, and many others
    for comments about the experimental format.)

    The release version number is now more accurate in the usual case
    where releases are built from a Git repository.  For example, if
    23 commits and some working-file changes have been made since
    release 2016g, the version number is now something like
    '2016g-23-g50556e3-dirty' instead of the misleading '2016g'.
    Official releases uses the same version number format as before,
    e.g., '2016g'.  To support the more-accurate version number, its
    specification has moved from a line in the Makefile to a new
    source file 'version'.

    The experimental distribution contains a file to2050.tzs that
    contains what should be the output of 'zdump -i -c 2050' on
    primary zones.  If this file is available, 'make check' now checks
    that zdump generates this output.

    'make check_web' now works on Fedora-like distributions.

  Changes to documentation and commentary

    tzfile.5 now documents the new restriction on POSIX TZ-like
    strings that is now implemented by zic.

    Comments now cite URLs for some 1917-1921 Russian DST decrees.
    (Thanks to Alexander Belopolsky.)

    tz-link.htm mentions JuliaTime (thanks to Curtis Vogt) and Time4J
    (thanks to Meno Hochschild) and ThreeTen-Extra, and its
    description of Java 8 has been brought up to date (thanks to
    Stephen Colebourne).  Its description of local time on Mars has
    been updated to match current practice, and URLs have been updated
    and some obsolete ones removed.

(From OE-Core rev: 19c365b23c3b835dcb5595aba598f35bf16a6d81)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agotzcode-native: update to 2016f
Armin Kuster [Thu, 7 Jul 2016 01:35:13 +0000 (18:35 -0700)]
tzcode-native: update to 2016f

changes done in data

(From OE-Core rev: 29377fa91a5f679909d582317c2b53d1f2e5da88)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agotzdata: update to 2016f
Armin Kuster [Thu, 7 Jul 2016 01:35:14 +0000 (18:35 -0700)]
tzdata: update to 2016f

 Changes affecting future time stamps

    The Egyptian government changed its mind on short notice, and
    Africa/Cairo will not introduce DST starting 2016-07-07 after all.
    (Thanks to Mina Samuel.)

    Asia/Novosibirsk switches from +06 to +07 on 2016-07-24 at 02:00.
    (Thanks to Stepan Golosunov.)

  Changes to past and future time stamps

    Asia/Novokuznetsk and Asia/Novosibirsk now use numeric time zone
    abbreviations instead of invented ones.

  Changes affecting past time stamps

    Europe/Minsk's 1992-03-29 spring-forward transition was at 02:00 not 00:00.
    (Thanks to Stepan Golosunov.)

(From OE-Core rev: dc80bf9b092a76f758d01474619cd9db46a1070d)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoopenssl: Security fix CVE-2016-6306
Armin Kuster [Sat, 24 Sep 2016 06:18:57 +0000 (23:18 -0700)]
openssl: Security fix CVE-2016-6306

affects openssl < 1.0.1i

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssl: Security fix CVE-2016-6304
Armin Kuster [Sat, 24 Sep 2016 06:16:30 +0000 (23:16 -0700)]
openssl: Security fix CVE-2016-6304

affects openssl < 1.0.1i

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssl: Security fix CVE-2016-6303
Armin Kuster [Sat, 24 Sep 2016 06:14:36 +0000 (23:14 -0700)]
openssl: Security fix CVE-2016-6303

affects openssl < 1.0.1i

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssl: Security fix CVE-2016-6302
Armin Kuster [Sat, 24 Sep 2016 06:13:04 +0000 (23:13 -0700)]
openssl: Security fix CVE-2016-6302

affects openssl < 1.0.1i

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssl: Security fix CVE-2016-2182
Armin Kuster [Sat, 24 Sep 2016 06:11:28 +0000 (23:11 -0700)]
openssl: Security fix CVE-2016-2182

affects openssl < 1.0.1i

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssl: Security fix CVE-2016-2181
Armin Kuster [Sat, 24 Sep 2016 06:09:29 +0000 (23:09 -0700)]
openssl: Security fix CVE-2016-2181

affects openssl < 1.0.1i

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssl: Security fix CVE-2016-2180
Armin Kuster [Sat, 24 Sep 2016 06:06:10 +0000 (23:06 -0700)]
openssl: Security fix CVE-2016-2180

affects openssl < 1.0.1i

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoinit-install.sh: fix disk_size
Robert Yang [Tue, 27 Sep 2016 14:15:36 +0000 (07:15 -0700)]
init-install.sh: fix disk_size

It mis-matched "SanDisk" or "Disk Flags" before, which caused unexpected
error.

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a68ac76c1b6ed4c1a2fbc944c5021c89fd26217f)
[YOCTO #10333]
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
8 years agoutil-linux: Security fix for CVE-2016-5011
Armin Kuster [Tue, 20 Sep 2016 04:51:14 +0000 (21:51 -0700)]
util-linux: Security fix for CVE-2016-5011

affects util-linux < 2.28.2

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoqemu: Secuirty fix for CVE-2016-5403
Armin Kuster [Tue, 20 Sep 2016 03:01:16 +0000 (20:01 -0700)]
qemu: Secuirty fix for CVE-2016-5403

affects qemu < 2.7.0-rc0

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoqemu: Security fix for CVE-2016-4002
Armin Kuster [Tue, 20 Sep 2016 02:56:19 +0000 (19:56 -0700)]
qemu: Security fix for CVE-2016-4002

affects qemu < 2.6.0

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoqemu: Security fix CVE-2016-6351
Armin Kuster [Tue, 20 Sep 2016 02:52:57 +0000 (19:52 -0700)]
qemu: Security fix CVE-2016-6351

affects qemu < 2.6.0

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoqemu: Security fix CVE-2016-4439
Armin Kuster [Tue, 20 Sep 2016 02:48:42 +0000 (19:48 -0700)]
qemu: Security fix CVE-2016-4439

affects qemu < 2.6.0

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoqemu: Security Fix CVE-2016-3712
Armin Kuster [Tue, 20 Sep 2016 01:12:42 +0000 (18:12 -0700)]
qemu: Security Fix CVE-2016-3712

affects qemu < 2.6.0

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoqemu: Security Fix CVE-2016-3710
Armin Kuster [Tue, 20 Sep 2016 01:02:55 +0000 (18:02 -0700)]
qemu: Security Fix CVE-2016-3710

affects Qemu < 2.6.0

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agowget: Security fix CVE-2016-4971
Armin Kuster [Sun, 18 Sep 2016 05:33:07 +0000 (22:33 -0700)]
wget: Security fix CVE-2016-4971

affects wget < 1.18.0

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssh: Security fix CVE-2015-8325
Armin Kuster [Sun, 18 Sep 2016 04:12:07 +0000 (21:12 -0700)]
openssh: Security fix CVE-2015-8325

openssh <  7.2p2

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssh: Security fix CVE-2016-5615
Armin Kuster [Sun, 18 Sep 2016 04:09:43 +0000 (21:09 -0700)]
openssh: Security fix CVE-2016-5615

openssh < 7.3

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoopenssh: Security fix CVE-2016-6210
Armin Kuster [Sun, 18 Sep 2016 03:58:40 +0000 (20:58 -0700)]
openssh: Security fix CVE-2016-6210

affects openssh < 7.3

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agogit: Security fix CVE-2016-2315 CVE-2016-2324
Armin Kuster [Sat, 17 Sep 2016 22:22:39 +0000 (15:22 -0700)]
git: Security fix CVE-2016-2315 CVE-2016-2324

git versions < 2.5.5 & 2.7.4

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agobind: Security fix CVE-2016-2088
Armin Kuster [Sat, 17 Sep 2016 21:22:15 +0000 (14:22 -0700)]
bind: Security fix CVE-2016-2088

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agotiff: Security fix CVE-2016-5323
Yi Zhao [Wed, 10 Aug 2016 07:11:20 +0000 (15:11 +0800)]
tiff: Security fix CVE-2016-5323

CVE-2016-5323 libtiff: a maliciously crafted TIFF file could cause the
application to crash when using tiffcrop command

External References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5323
http://bugzilla.maptools.org/show_bug.cgi?id=2559

Patch from:
https://github.com/vadz/libtiff/commit/2f79856097f423eb33796a15fcf700d2ea41bf31

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 4ad1220e0a7f9ca9096860f4f9ae7017b36e29e4)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agotiff: Security fix CVE-2016-5321
Yi Zhao [Wed, 10 Aug 2016 07:11:19 +0000 (15:11 +0800)]
tiff: Security fix CVE-2016-5321

CVE-2016-5321 libtiff: a maliciously crafted TIFF file could cause the
application to crash when using tiffcrop command

External References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5321
http://bugzilla.maptools.org/show_bug.cgi?id=2558

Patch from:
https://github.com/vadz/libtiff/commit/d9783e4a1476b6787a51c5ae9e9b3156527589f0

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 4a167cfb6ad79bbe2a2ff7f7b43c4a162ca42a4d)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agotiff: Security fix CVE-2016-3186
Yi Zhao [Wed, 10 Aug 2016 07:11:18 +0000 (15:11 +0800)]
tiff: Security fix CVE-2016-3186

CVE-2016-3186 libtiff: buffer overflow in the readextension function in
gif2tiff.c allows remote attackers to cause a denial of service via a
crafted GIF file

External References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3186
https://bugzilla.redhat.com/show_bug.cgi?id=1319503

Patch from:
https://bugzilla.redhat.com/attachment.cgi?id=1144235&action=diff

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 3d818fc862b1d85252443fefa2222262542a10ae)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agolibpcre: Fix CVE-2016-3191
Ismo Puustinen [Wed, 4 May 2016 13:06:46 +0000 (16:06 +0300)]
libpcre: Fix CVE-2016-3191

Fix workspace overflow for (*ACCEPT) with deeply nested parentheses.

The patch is from libpcre version control at
http://vcs.pcre.org/pcre?view=revision&revision=1631 with the ChangeLog
part removed. Original author is Philip Hazel.

Signed-off-by: Ismo Puustinen <ismo.puustinen@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 386534f968f4da376ba7778b5d436bad4ce8355b)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoopenssl: Security fix CVE-2016-2178
Armin Kuster [Sat, 16 Jul 2016 23:04:12 +0000 (16:04 -0700)]
openssl: Security fix CVE-2016-2178

affects  openssl <=  1.0.2h
CVSS v2 Base Score: 2.1 LOW

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 5b3df0c5e8885ea34f66b41fcf209a9960fbbf5e)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoopenssl: Security fix CVE-2016-2177
Armin Kuster [Sat, 16 Jul 2016 23:04:11 +0000 (16:04 -0700)]
openssl: Security fix CVE-2016-2177

Affects openssl <= 1.0.2h
CVSS v2 Base Score: 7.5 HIGH

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 2848c7d3e454cbc84cba9183f23ccdf3e9200ec9)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agoopenssl: add a patch to fix parallel builds
Ross Burton [Sat, 5 Mar 2016 00:12:02 +0000 (00:12 +0000)]
openssl: add a patch to fix parallel builds

Apply a patch taken from Gentoo to hopefully fix the remaining parallel make
races.

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 3d806d59a4c5e8ff35c7e7c5a3a6ef85e2b4b259)

Minor fixup to get patch to apply to jethro
Signed-off-by: Armin Kuster <akuster808@gmail.com>
8 years agocurl: security fix for CVE-2016-5421
Maxin B. John [Mon, 22 Aug 2016 08:39:33 +0000 (11:39 +0300)]
curl: security fix for CVE-2016-5421

Affected versions: libcurl 7.32.0 to and including 7.50.0

Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
8 years agocurl: security fix for CVE-2016-5420
Maxin B. John [Mon, 22 Aug 2016 08:39:32 +0000 (11:39 +0300)]
curl: security fix for CVE-2016-5420

Affected versions: libcurl 7.1 to and including 7.50.0

Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
8 years agocurl: security fix for CVE-2016-5419
Maxin B. John [Mon, 22 Aug 2016 08:39:31 +0000 (11:39 +0300)]
curl: security fix for CVE-2016-5419

Affected versions: libcurl 7.1 to and including 7.50.0

Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
8 years agoperl-ptest.inc: fix tar call to prevent objcopy failure
Enrico Jorns [Mon, 30 May 2016 13:04:05 +0000 (15:04 +0200)]
perl-ptest.inc: fix tar call to prevent objcopy failure

With tar version 1.29, the tar call used to copy the ptest files will
not work anymore. While the call did not match the man page (but worked)
before, anyway, the latest update of tar seems to have a more strict argument
handling.

With the current version of the tar call, the copying of files still
works with latest tar version, but the excludes will not be handled
properly anymore.
This results in having binaries compiled with host GCC in the package.
When doing the strip_and_split files in do_package() with the target
objcopy, bitbake will fail with this error:

  ERROR: objcopy failed with exit code 256 (cmd was [...])
  [...]
  File format not recognized

Thus, the current argument issues and required changes are:

 * Options must be placed _before_ the pathnames.

 * --exclude must be followd by a '=' in order to work properly

 * 'f' options is for providing an archive file, which is unnecessary in
   this case

Note that this could also be a candidate for backporting.

(From OE-Core master rev: 2e498879098f7d84610aed7961d92433083d9a02)

Signed-off-by: Enrico Jorns <ejo@pengutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
8 years agogcc: make sure header path is set correctly
Anuj Mittal [Tue, 14 Jun 2016 09:10:20 +0000 (17:10 +0800)]
gcc: make sure header path is set correctly

We're setting the native header paths in do_configure_prepend,
and don't need to set them again here.

This results in gcc-target not being able to locate the headers
and not being able to detect glibc version, which in turn
results in SSP support not getting detected even though it's available
in libc.

(From OE-Core master rev: 85630aa894278e7818c867179dc19ca2fbd994fc)

Signed-off-by: Anuj Mittal <anujx.mittal@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
8 years agotzdata: update to 2016e
Armin Kuster [Tue, 14 Jun 2016 21:50:22 +0000 (14:50 -0700)]
tzdata: update to 2016e

Changes affecting future time stamps

Africa/Cairo observes DST in 2016 from July 7 to the end of October.
Guess October 27 and 24:00 transitions. (Thanks to Steffen Thorsen.)
For future years, guess April's last Thursday to October's last
Thursday except for Ramadan.

Changes affecting past time stamps

Locations while uninhabited now use '-00', not 'zzz', as a
placeholder time zone abbreviation.  This is inspired by Internet
RFC 3339 and is more consistent with numeric time zone
abbreviations already used elsewhere.  The change affects several
arctic and antarctic locations, e.g., America/Cambridge_Bay before
1920 and Antarctica/Troll before 2005.

Asia/Baku's 1992-09-27 transition from +04 (DST) to +04 (non-DST) was
at 03:00, not 23:00 the previous day.  (Thanks to Michael Deckers.)

(From OE-Core master rev: ddcf128e76ed0678ce42416531f4ecb309c57439)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
8 years agotzcode: update to 2016e
Armin Kuster [Tue, 14 Jun 2016 21:50:21 +0000 (14:50 -0700)]
tzcode: update to 2016e

V2: typo in title (jet lagged)
Changes to code

zic now outputs a dummy transition at time 2**31 - 1 in zones
whose POSIX-style TZ strings contain a '<'.  This mostly works
around Qt bug 53071 <https://bugreports.qt.io/browse/QTBUG-53071>.
(Thanks to Zhanibek Adilbekov for reporting the Qt bug.)

Changes affecting documentation and commentary

tz-link.htm says why governments should give plenty of notice for
time zone or DST changes, and refers to Matt Johnson's blog post.
tz-link.htm mentions Tzdata for Elixir.  (Thanks to Matt Johnson.)

(From OE-Core master rev: 5f3340e5c966f4233e0cd4ec468b20a1fd5a7346)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
8 years agowic: fix path parsing, use last occurrence
George McCollister [Fri, 13 May 2016 14:22:53 +0000 (09:22 -0500)]
wic: fix path parsing, use last occurrence

If the path contains 'scripts' more than once the first occurrence will be
incorrectly used. Use rfind instead of find to find the last occurrence.

Signed-off-by: George McCollister <george.mccollister@gmail.com>
8 years agobluez5: move btmgmt to common READLINE section
Nicolas Dechesne [Wed, 25 May 2016 15:19:53 +0000 (17:19 +0200)]
bluez5: move btmgmt to common READLINE section

Upstream in 5.33 btmgmt was moved from experimental to common READLINE section,
in commit e4f0c5582f1fe3451d5588243adba9de1ed68b80, but this was never updated
in the recipe.

This is a backport from master branch, commit
28777e593d3dd3a5d0ee2effcdca6a971e2887f9.

Signed-off-by: Nicolas Dechesne <nicolas.dechesne@linaro.org>
8 years agolibxml2: Security fix for CVE-2016-4448
Armin Kuster [Sat, 9 Jul 2016 22:20:50 +0000 (15:20 -0700)]
libxml2: Security fix for CVE-2016-4448

Affects libxml2 < 2.9.4

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-4447
Armin Kuster [Sat, 9 Jul 2016 22:12:44 +0000 (15:12 -0700)]
libxml2: Security fix for CVE-2016-4447

Affects libxml2 < 2.9.4

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-3627
Armin Kuster [Sat, 9 Jul 2016 22:06:40 +0000 (15:06 -0700)]
libxml2: Security fix for CVE-2016-3627

Affects libxml2 < 2.9.4

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-1833
Armin Kuster [Sat, 9 Jul 2016 22:03:43 +0000 (15:03 -0700)]
libxml2: Security fix for CVE-2016-1833

Affects libxml2 < 2.9.4

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-1835
Armin Kuster [Sat, 9 Jul 2016 22:02:26 +0000 (15:02 -0700)]
libxml2: Security fix for CVE-2016-1835

Affects libxml2 < 2.9.4

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-1837
Armin Kuster [Sat, 9 Jul 2016 22:01:15 +0000 (15:01 -0700)]
libxml2: Security fix for CVE-2016-1837

Affects libxml2 < 2.9.4

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-4449
Armin Kuster [Sat, 9 Jul 2016 21:59:57 +0000 (14:59 -0700)]
libxml2: Security fix for CVE-2016-4449

Affects limbxml2 < 2.9.4

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-1836
Armin Kuster [Sat, 9 Jul 2016 21:58:22 +0000 (14:58 -0700)]
libxml2: Security fix for CVE-2016-1836

Affects libxml2 < 2.9.4

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-1839
Armin Kuster [Sat, 9 Jul 2016 21:57:08 +0000 (14:57 -0700)]
libxml2: Security fix for CVE-2016-1839

Affects libxml2 < 2.9.4

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-1838
Armin Kuster [Sat, 9 Jul 2016 21:55:49 +0000 (14:55 -0700)]
libxml2: Security fix for CVE-2016-1838

Affects libxml2 < 2.9.4

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-1840
Armin Kuster [Sat, 9 Jul 2016 21:54:21 +0000 (14:54 -0700)]
libxml2: Security fix for CVE-2016-1840

affects libxml2 < 2.9.4

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-4483.patch
Armin Kuster [Sat, 9 Jul 2016 21:31:00 +0000 (14:31 -0700)]
libxml2: Security fix for CVE-2016-4483.patch

affects libxml2 < 2.9.4

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-1834.patch
Armin Kuster [Sat, 9 Jul 2016 21:29:54 +0000 (14:29 -0700)]
libxml2: Security fix for CVE-2016-1834.patch

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-3705
Armin Kuster [Sat, 9 Jul 2016 21:28:45 +0000 (14:28 -0700)]
libxml2: Security fix for CVE-2016-3705

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agolibxml2: Security fix for CVE-2016-1762
Armin Kuster [Sat, 9 Jul 2016 21:27:44 +0000 (14:27 -0700)]
libxml2: Security fix for CVE-2016-1762

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoglibc: Security fix for CVE-2016-4429
Armin Kuster [Sat, 9 Jul 2016 18:56:49 +0000 (11:56 -0700)]
glibc: Security fix for CVE-2016-4429

Signed-off-by: Armin Kuster <akuster@mvista.com>
8 years agoglibc: Security Fix for CVE-2016-3706
Armin Kuster [Sat, 9 Jul 2016 18:55:29 +0000 (11:55 -0700)]
glibc: Security Fix for CVE-2016-3706

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agotoasterconf.json: exclude releases Toaster can't build
Elliot Smith [Fri, 3 Jun 2016 10:09:19 +0000 (11:09 +0100)]
toasterconf.json: exclude releases Toaster can't build

Due to changes in master to support Python 3, Toaster is no
longer able to build from master.

Remove references to master and set default release to jethro.

The dizzy release should also be removed, as Toaster jethro
is unable to build using this release.

Signed-off-by: Elliot Smith <elliot.smith@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agowic: insert local Python paths at front
Matt Madison [Sun, 6 Dec 2015 16:53:22 +0000 (08:53 -0800)]
wic: insert local Python paths at front

This follows how bitbake performs path insertion, and fixes a
failure to start wic on Ubuntu 15.10 with the distribution's
version of python-ply installed.

Signed-off-by: Matt Madison <matt@madison.systems>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agobuild-appliance-image: Update to jethro head revision
Richard Purdie [Mon, 23 May 2016 16:35:01 +0000 (17:35 +0100)]
build-appliance-image: Update to jethro head revision

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agobuild-appliance-image: Update to jethro head revision
Richard Purdie [Mon, 23 May 2016 16:25:06 +0000 (17:25 +0100)]
build-appliance-image: Update to jethro head revision

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agogdb: Backport patch to changes with AVX and MPX
Saul Wold [Thu, 19 May 2016 22:25:44 +0000 (15:25 -0700)]
gdb: Backport patch to changes with AVX and MPX

The current MPX target descriptions assume that MPX is always combined
with AVX, however that's not correct.  We can have machines with MPX
and without AVX; or machines with AVX and without MPX.

This patch adds new target descriptions for machines that support
both MPX and AVX, as duplicates of the existing MPX descriptions.

The following commit will remove AVX from the MPX-only descriptions.

This commit is backported from 7.12

Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agogcc: Security Fix CVE-2016-4490
Armin Kuster [Wed, 11 May 2016 00:41:21 +0000 (17:41 -0700)]
gcc: Security Fix CVE-2016-4490

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agogcc: Security fix CVE-2016-2226
Armin Kuster [Wed, 11 May 2016 00:32:55 +0000 (17:32 -0700)]
gcc: Security fix CVE-2016-2226

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agogcc: Security fix CVE-2016-4489
Armin Kuster [Wed, 11 May 2016 00:26:39 +0000 (17:26 -0700)]
gcc: Security fix CVE-2016-4489

Signed-off-by: Armin Kuster <akuster808@gmail.com>
9 years agogcc: Security fix CVE-2016-4488
Armin Kuster [Thu, 5 May 2016 22:12:58 +0000 (15:12 -0700)]
gcc: Security fix CVE-2016-4488

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agoopenssl: prevent ABI break from earlier jethro releases
Joshua Lock [Fri, 13 May 2016 23:49:58 +0000 (16:49 -0700)]
openssl: prevent ABI break from earlier jethro releases

The backported upgrade to 1.0.2h included an updated GNU LD
version-script which results in an ABI change. In order to try and
respect ABI for existing binaries built against fido this commit
partially reverts the version-script to maintain the existing ABI
and instead only add the new symbols required by 1.0.2h.

Suggested-by: Martin Jansa <martin.jansa@gmail.com>
(From OE-Core rev: 480db6be99f9a53d8657b31b846f0079ee1a124f)

Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agoopenssh: Security Fix CVE-2016-3115
Armin Kuster [Wed, 27 Apr 2016 22:20:00 +0000 (15:20 -0700)]
openssh: Security Fix CVE-2016-3115

opehssh <= 7.2

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agobusybox: Security fix CVE-2016-2147
Armin Kuster [Wed, 27 Apr 2016 20:29:51 +0000 (13:29 -0700)]
busybox: Security fix CVE-2016-2147

busybox <= 1.24.2

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agobusybox: Security Fix CVE-2016-2148
Armin Kuster [Wed, 27 Apr 2016 20:28:01 +0000 (13:28 -0700)]
busybox: Security Fix CVE-2016-2148

busybox <= 1.24.2

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agolibtiff: Security fix CVE-2015-8664 and 8683
Armin Kuster [Tue, 26 Apr 2016 20:19:44 +0000 (13:19 -0700)]
libtiff: Security fix CVE-2015-8664 and 8683

CVE-2015-8665
CVE-2015-8683

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agoopenssl: 1.0.2d -> 1.0.2h (mainly for CVEs)
Robert Yang [Wed, 11 May 2016 07:43:28 +0000 (00:43 -0700)]
openssl: 1.0.2d -> 1.0.2h (mainly for CVEs)

* CVEs:
  - CVE-2016-0705
  - CVE-2016-0798
  - CVE-2016-0797
  - CVE-2016-0799
  - CVE-2016-0702
  - CVE-2016-0703
  - CVE-2016-0704
  - CVE-2016-2105
  - CVE-2016-2106
  - CVE-2016-2109
  - CVE-2016-2176

* The LICENSE's checksum is changed because of date changes (2011 ->
  2016), the contents are the same.

* Remove backport patches
  - 0001-Add-test-for-CVE-2015-3194.patch
  - CVE-2015-3193-bn-asm-x86_64-mont5.pl-fix-carry-propagating-bug-CVE.patch
  - CVE-2015-3194-1-Add-PSS-parameter-check.patch
  - CVE-2015-3195-Fix-leak-with-ASN.1-combine.patch
  - CVE-2015-3197.patch
  - CVE-2016-0701_1.patch
  - CVE-2016-0701_2.patch
  - CVE-2016-0800.patch
  - CVE-2016-0800_2.patch
  - CVE-2016-0800_3.patch

* Update crypto_use_bigint_in_x86-64_perl.patch

* Add version-script.patch and update block_diginotar.patch (From master branch)

* Update openssl-avoid-NULL-pointer-dereference-in-EVP_DigestInit_ex.patch
  (From Armin)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agoRevert "kernel/kernel-arch: Explicitly mapping between, i386/x86_64 and x86 for kerne...
Tom Zanussi [Tue, 10 May 2016 21:50:05 +0000 (16:50 -0500)]
Revert "kernel/kernel-arch: Explicitly mapping between, i386/x86_64 and x86 for kernel ARCH"

This reverts commit a6f52930a68d8462e23486d51cdda715072dd752.

In addition to also causing the problem in [YOCTO #9579], this commit
was reverted in krogoth and master but wasn't reverted in jethro but
should be.  The original revert message was:

This reverts commit 8d310b24927d0f348fb431895f0583733db2aad0.

That commit completely breaks KBUILD_DEFCONFIG because it relies on
$ARCH to match between the target OE arch and the kernel subdirectory
containing the defconfigs. In the kernel all defconfigs for everything
x86-based (including x86_64) is stored in dir arch/x86/configs/

kernel-yocto.bbclass correctly searches for all the defconfigs inside
${S}/arch/${ARCH}/configs/${KBUILD_DEFCONFIG}

Commit 8d310b249 makes it search in wrong places and _only_ if you
define TARGET_ARCH = "athlon" will it search x86 which is nonsensical.

The commit further adds an if clause to hack the mungled kernel arches
back to their original values (ugh) in do_shared_workdir which is run
after do compile, but of course the build breaks before that in
do_kernel_metadata because of the KBUILD_DEFCONFIG mentioned above (so
that hack is useless).

Please fix that corner case bug in another way which does not completely
screw up the kernel arch mapping & defconfig logic. If 64bit configs are
generated in the kernel for 32bit machines because the host is asked,
then it it a bug in the kernel, it is of no use to hack around it in OE.

(From OE-Core rev: bc02a478a5d4a5de7b3943ed809d5c22711f5b1f)

Signed-off-by: Ioan-Adrian Ratiu <adrian.ratiu@ni.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Tom Zanussi <tom.zanussi@linux.intel.com>
9 years agoglew: Correct version in autotooling patches
Martyn Welch [Wed, 27 Apr 2016 11:25:00 +0000 (12:25 +0100)]
glew: Correct version in autotooling patches

The additional autotooling patched into glew claims the version is 1.9.0
whilst we are building 1.12.0. The version in the autotooling is used to
set the version number in the pkgconfig file, this results in the
configuration of packages which depend on glew > 1.9.0 failing.

This patch updates the version number used in the patches to match that of
the version being built.

Signed-off-by: Martyn Welch <martyn.welch@collabora.co.uk>
9 years agogdb: fix QA warning (uClibc)
André Draszik [Fri, 29 Apr 2016 10:52:38 +0000 (11:52 +0100)]
gdb: fix QA warning (uClibc)

WARNING: QA Issue: gdb rdepends on libiconv, but it isn't a build dependency? [build-deps]

We already have virtual/libiconv which is set appropriately
in all environments, so let's use it to fix the issue.

Signed-off-by: André Draszik <adraszik@tycoint.com>
9 years agobinutils: backport bug fix to the 2.25 branch for jethro
Tristan Van Berkom [Wed, 27 Apr 2016 21:39:40 +0000 (17:39 -0400)]
binutils: backport bug fix to the 2.25 branch for jethro

We fail to build webkit on aarch64 due to this binutils bug:

   https://sourceware.org/bugzilla/show_bug.cgi?id=19353

Applying patch which fixes this, stripped out changelog entry
from patch to make it apply without error.

9 years agoglibc: Fix CVE-2015-8778
Yuanjie Huang [Wed, 27 Apr 2016 09:32:55 +0000 (02:32 -0700)]
glibc: Fix CVE-2015-8778

CVE: CVE-2015-8778

Improve check against integer wraparound in hcreate_r [BZ #18240]

This is an integer overflow in hcreate and hcreate_r which can result in
an out-of-bound memory access.  This could lead to application crashes
or, potentially, arbitrary code execution.

Upstream-Status: Backport [2.23]
(cherry-picked from commit bae7c7c74bd228c8)

Signed-off-by: Yuanjie Huang <yuanjie.huang@windriver.com>
9 years agoboot-directdisk.bbclass: remove HDDIMG before create
Robert Yang [Mon, 25 Apr 2016 01:10:38 +0000 (18:10 -0700)]
boot-directdisk.bbclass: remove HDDIMG before create

Fixed when rebuild:
mkdosfs: file /path/to/hdd.image already exists

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry-pick from 9abcd309c098558360cde2bff65be840ead25f83)
Signed-off-by: Tim Kilbourn <tkilbourn@gmail.com>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agoopkg: backport fix for double remove of packges
Stefan Agner [Mon, 25 Apr 2016 01:10:37 +0000 (18:10 -0700)]
opkg: backport fix for double remove of packges

Backport the fix 7885da3974 ("pkg_get_provider_replacees: do not
add installed pkg to replacee list"). This avoids opkg trying to
remove a package twice e.g. when upgrading.

Suggested-by: Alejandro del Castillo <alejandro.delcastillo@ni.com>
Signed-off-by: Stefan Agner <stefan.agner@toradex.com>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>