aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2016-02-18glibc: Security fix CVE-2015-7547Joshua Lock
CVE-2015-7547: getaddrinfo() stack-based buffer overflow (Based on OE-Core rev: cf754c5c806307d6eb522d4272b3cd7485f82420) Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
2016-02-16kernel.bbclass: do not mv/link sources when externalsrc enabledMarkus Lehtonen
If externalsrc is enabled the 'do_unpack' task is run if the recipe has some local source files. In the case of kernel recipe this caused the (externalsrc) source tree to be moved/symlinked. This patch prevents the behaviour, making sure the source tree is not moved around when externalsrc is enabled. Instead of moving the source tree, STAGING_KERNEL_DIR will be a symlink to it. [YOCTO #6658] (From OE-Core master rev: 8f6c564661a3801012eb2d9a98cdc99c91712367) Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
2016-02-16libpcre: Security fixes and package update.Armin Kuster
this is related to [Yocto # 9008] 8.38: The following security fixes are included: CVE-2015-3210 pcre: heap buffer overflow in pcre_compile2() compile_regex() CVE-2015-3217 pcre: stack overflow in match() CVE-2015-5073 CVE-2015-8388 pcre: Buffer overflow caused by certain patterns with an unmatched closing parenthesis CVE-2015-8380 pcre: Heap-based buffer overflow in pcre_exec CVE-2015-8381 pcre: Heap Overflow in compile_regex() CVE-2015-8383 pcre: Buffer overflow caused by repeated conditional group CVE-2015-8384 pcre: Buffer overflow caused by recursive back reference by name within certain group CVE-2015-8385 pcre: Buffer overflow caused by forward reference by name to certain group CVE-2015-8386 pcre: Buffer overflow caused by lookbehind assertion CVE-2015-8387 pcre: Integer overflow in subroutine calls CVE-2015-8389 pcre: Infinite recursion in JIT compiler when processing certain patterns CVE-2015-8390 pcre: Reading from uninitialized memory when processing certain patterns CVE-2015-8392 pcre: Buffer overflow caused by certain patterns with duplicated named groups CVE-2015-8393 pcre: Information leak when running pcgrep -q on crafted binary CVE-2015-8394 pcre: Integer overflow caused by missing check for certain conditions CVE-2015-8395 pcre: Buffer overflow caused by certain references CVE-2016-1283 pcre: Heap buffer overflow in pcre_compile2 causes DoS 8.37: The following security fixes are included: CVE-2014-8964 pcre: incorrect handling of zero-repeat assertion conditions CVE-2015-2325 pcre: heap buffer overflow in compile_branch() CVE-2015-2326 pcre: heap buffer overflow in pcre_compile2() LICENSE file changed do to Copyright date updates. Signed-off-by: Armin Kuster <akuster@mvista.com> Jethro and master don't require this patch as they have newer libpcre which contains these fixes. Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
2016-02-16tzdata: remove 2015d versionMartin Jansa
* this is left-over from upgrade to 2016a * it's safer to remove so that .bbappends in other layers really apply to version used in build (currently we have bbappend for 2015d and build will use 2016a without any warning * the same problem was reported with 2015f upgrade: http://lists.openembedded.org/pipermail/openembedded-core/2015-August/109708.html Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Not required by other branches as this is removing a leftover file in Fido only. Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
2016-02-16rpmresolve.c: Fix unfreed pointers that keep DB openedMariano Lopez
There are some unfreed rpmmi pointers in printDepList() function; this happens when the package have null as the requirement. This patch fixes these unfreed pointers and add small changes to keep consistency with some variables. [YOCTO #8028] (From OE-Core master rev: da7aa183f94adc1d0fff5bb81e827c584f9938ec) Signed-off-by: Mariano Lopez <mariano.lopez@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
2016-02-07dpkg: Security fix CVE-2015-0860Armin Kuster
CVE-2015-0860 dpkg: stack overflows and out of bounds read (From OE-Core rev: 5aaec01acc9e5a19374a566307a425d43c887f4b) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2016-02-07bind: Security fix CVE-2015-8704Armin Kuster
CVE-2015-8704 bind: specific APL data could trigger an INSIST in apl_42.c Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07libxml2: Security fix CVE-2015-8710Armin Kuster
CVE-2015-8710 libxml2: out-of-bounds memory access when parsing an unclosed HTML comment (From OE-Core rev: 03d481070ebc6f9af799aec5d038871f9c73901c) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07libxml2: Security fix CVE-2015-8241Armin Kuster
CVE-2015-8241 libxml2: Buffer overread with XML parser in xmlNextChar (From OE-Core rev: f3c19a39cdec435f26a7f46a3432231ba4daa19c) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07tzdata: reinstate changes reverted in 2014c upgradePaul Eggleton
OE-Core commit 57af3fb9662106f0a65a1b4edf83e2398be0a8f1 upgraded tzdata but also reverted a couple of changes to SUMMARY and LIC_FILES_CHKSUM. Reinstate these (with an update to the README md5 value since that has changed slightly, without any change to the licensing statements within). (From OE-Core rev: cea4f6b86129f84a99700207777929bf7e811ed6) Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07tzdata: update to 2016aArmin Kuster
Changed LIC_CHKSUM_FILES to a new LICENSE file. Add BSD-3-clause to licenses Changes affecting future time stamps America/Cayman will not observe daylight saving this year after all. Revert our guess that it would. (Thanks to Matt Johnson.) Asia/Chita switches from +0800 to +0900 on 2016-03-27 at 02:00. (Thanks to Alexander Krivenyshev.) Asia/Tehran now has DST predictions for the year 2038 and later, to be March 21 00:00 to September 21 00:00. This is likely better than predicting no DST, albeit off by a day every now and then. Changes affecting past and future time stamps America/Metlakatla switched from PST all year to AKST/AKDT on 2015-11-01 at 02:00. (Thanks to Steffen Thorsen.) America/Santa_Isabel has been removed, and replaced with a backward compatibility link to America/Tijuana. Its contents were apparently based on a misreading of Mexican legislation. Changes affecting past time stamps Asia/Karachi's two transition times in 2002 were off by a minute. (Thanks to Matt Johnson.) (From OE-Core rev: 790315dbd2dcb5b2024948ef412f32d2788cb6b5) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 39e231cfabda8d75906c935d2a01f37df6121b84) Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07tzcode: update to 2016aArmin Kuster
Change LIC_CHKSUM_FILES to License. Some files are BSD clause 3 Changes affecting build procedure An installer can now combine leap seconds with use of the backzone file, e.g., with 'make PACKRATDATA=backzone REDO=posix_right zones'. The old 'make posix_packrat' rule is now marked as obsolescent. (Thanks to Ian Abbott for an initial implementation.) Changes affecting documentation and commentary A new file LICENSE makes it easier to see that the code and data are mostly public-domain. (Thanks to James Knight.) The three non-public-domain files now use the current (3-clause) BSD license instead of older versions of that license. tz-link.htm mentions the BDE library (thanks to Andrew Paprocki), CCTZ (thanks to Tim Parenti), TimeJones.com, and has a new section on editing tz source files (with a mention of Sublime zoneinfo, thanks to Gilmore Davidson). The Theory and asia files now mention the 2015 book "The Global Transformation of Time, 1870-1950", and cite a couple of reviews. The America/Chicago entry now documents the informal use of US central time in Fort Pierre, South Dakota. (Thanks to Rick McDermid, Matt Johnson, and Steve Jones.) (From OE-Core rev: 1ee9072e16d96f95d07ec5a1f63888ce4730d60e) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit b7f292b84eea202fb13730c11452ac1957e41cf0) Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07qemu: Security fix CVE-2015-7295Armin Kuster
CVE-2015-7295 Qemu: net: virtio-net possible remote DoS (From OE-Core rev: 74771f8c41aaede0ddfb86983c6841bd1f1c1f0f) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07qemu: Security fix CVE-2016-1568Armin Kuster
CVE-2016-1568 Qemu: ide: ahci use-after-free vulnerability in aio port commands (From OE-Core rev: 166c19df8be28da255cc68032e2d11afc59d4197) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07qemu: Security fix CVE-2015-8345Armin Kuster
CVE-2015-8345 Qemu: net: eepro100: infinite loop in processing command block list (From OE-Core rev: 99ffcd66895e4ba064542a1797057e45ec4d3220) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07qemu: Security fix CVE-2015-7512Armin Kuster
CVE-2015-7512 Qemu: net: pcnet: buffer overflow in non-loopback mod (From OE-Core rev: e6e9be51f77c9531f49cebe0ca6b495c23cf022d) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07qemu: Security fix CVE-2015-7504Armin Kuster
CVE-2015-7504 Qemu: net: pcnet: heap overflow vulnerability in loopback mode (From OE-Core rev: b01b569d7d7e651a35fa38750462f13aeb64a2f3) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07qemu: Security fix CVE-2015-8504Armin Kuster
CVE-2015-8504 Qemu: ui: vnc: avoid floating point exception (From OE-Core rev: c622bdd7133d31d7fbefe87fb38187f0aea4b592) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07subversion: fix CVE-2015-3187Wenzong Fan
The svn_repos_trace_node_locations function in Apache Subversion before 1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used, allows remote authenticated users to obtain sensitive path information by reading the history of a node that has been moved from a hidden path. Patch is from: http://subversion.apache.org/security/CVE-2015-3187-advisory.txt (From OE-Core master rev: 6da25614edcad30fdb4bea8ff47b81ff81cdaed2) (From OE-Core rev: e1e277bf51c6f00268358f6bf8623261b1b9bc22) Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07subversion: fix CVE-2015-3184Wenzong Fan
mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote anonymous users to read hidden files via the path name. Patch is from: http://subversion.apache.org/security/CVE-2015-3184-advisory.txt (From OE-Core master rev: 29eb921ed074d86fa8d5b205a313eb3177473a63) (From OE-Core rev: 7af7a3e692a6cd0d92768024efe32bfa7d83bc8f) Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07openssl: Security fix CVE-2016-0701Armin Kuster
CVE-2016-0701 OpenSSL: DH small subgroups (From OE-Core rev: c5868a7cd0a28c5800dfa4be1c9d98d3de08cd12) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07openssl: Security fix CVE-2015-3197Armin Kuster
CVE-2015-3197 OpenSSL: SSLv2 doesn't block disabled ciphers (From OE-Core rev: b387d9b8dff8e2c572ca14f9628ab8298347fd4f) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07glibc: CVE-2015-8776Armin Kuster
it was found that out-of-range time values passed to the strftime function may cause it to crash, leading to a denial of service, or potentially disclosure information. (From OE-Core rev: b9bc001ee834e4f8f756a2eaf2671aac3324b0ee) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07glibc: CVE-2015-9761Armin Kuster
A stack overflow vulnerability was found in nan* functions that could cause applications which process long strings with the nan function to crash or, potentially, execute arbitrary code. (From OE-Core rev: fd3da8178c8c06b549dbc19ecec40e98ab934d49) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07glibc: CVE-2015-8779Armin Kuster
A stack overflow vulnerability in the catopen function was found, causing applications which pass long strings to the catopen function to crash or, potentially execute arbitrary code. (From OE-Core rev: af20e323932caba8883c91dac610e1ba2b3d4ab5) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07glibc: CVE-2015-8777Armin Kuster
The process_envvars function in elf/rtld.c in the GNU C Library (aka glibc or libc6) before 2.23 allows local users to bypass a pointer-guarding protection mechanism via a zero value of the LD_POINTER_GUARD environment variable. (From OE-Core rev: 22570ba08d7c6157aec58764c73b1134405b0252) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-01-20openssh: CVE-2016-077xArmin Kuster
this address two CVE's. CVE-2016-0777 and CVE-2016-0778 Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-01-15logrotate: do not move binary logrotate to /usr/binHongxu Jia
In oe-core commit a46d3646a3e1781be4423b508ea63996b3cfca8a ... Author: Fahad Usman <fahad_usman@mentor.com> Date: Tue Aug 26 13:16:48 2014 +0500 logrotate: obey our flags Needed to quiet GNU_HASH warnings, and some minor fixes. ... it explicitly move logrotate to /usr/bin without any reason, which is against the original Linux location /usr/sbin. So partly revert the above commit which let logrotate be kept in the original place /usr/sbin. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-01-15libxml2: security fix CVE-2015-5312Armin Kuster
Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
2016-01-15libxml2: security fix CVE-2015-8242Armin Kuster
Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
2016-01-15libxml2: security fix CVE-2015-7500Armin Kuster
includes a depend fix security issue CVE-2015-7500 Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
2016-01-15libxml2: security fix CVE-2015-7499Armin Kuster
includes: CVE-2015-7499-1 CVE-2015-7499-2 Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
2016-01-15libxml2: security fix CVE-2015-7497Armin Kuster
Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
2016-01-15libxml2: security fix CVE-2015-7498Armin Kuster
Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
2016-01-15libxml2: security fix CVE-2015-8035Armin Kuster
Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
2016-01-15libxml2: security fix CVE-2015-7942Armin Kuster
includes: CVE-2015-7942 CVE-2015-7942-2 Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
2016-01-15libxml2: security fix CVE-2015-8317Armin Kuster
Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
2016-01-15libxml2: security fix CVE-2015-7941Armin Kuster
includes: CVE-2015-7941-1 CVE-2015-7941-2 Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
2016-01-15libxml2: remove files for easier maintenanceJoshua Lock
Drop a couple of CVE fixes for easy cherry-picking from jethro. The same fixes will be pack-ported from jethro in a following patch. Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
2016-01-15openssl: fix for CVE-2015-3195Armin Kuster
Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
2016-01-15openssl: fix for CVE-2015-3194Armin Kuster
Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
2016-01-15openssl: fix for CVE-2015-3193Armin Kuster
Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
2016-01-15texinfo: don't create dependency on INHERIT variableMartin Jansa
* we don't want the do_package signature depending on INHERIT variable * e.g. just adding the own-mirrors causes texinfo to rebuild: # bitbake-diffsigs BUILD/sstate-diff/*/*/texinfo/*do_package.sig* basehash changed from 015df2fd8e396cc1e15622dbac843301 to 9f1d06c4f238c70a99ccb6d8da348b6a Variable INHERIT value changed from ' rm_work blacklist blacklist report-error ${PACKAGE_CLASSES} ${USER_CLASSES} ${INHERIT_DISTRO} ${INHERIT_BLACKLIST} sanity' to ' rm_work own-mirrors blacklist blacklist report-error ${PACKAGE_CLASSES} ${USER_CLASSES} ${INHERIT_DISTRO} ${INHERIT_BLACKLIST} sanity' Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
2016-01-11grub2: Fix CVE-2015-8370Belal, Awais
http://git.savannah.gnu.org/cgit/grub.git/commit/?id=451d80e52d851432e109771bb8febafca7a5f1f2 Signed-off-by: Awais Belal <awais_belal@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
2016-01-07openssl: fix SRC_URIThomas PERROT
Corrects the URI of the openssl's recipe from fido. The sources were moved to a new subdirectory. Signed-off-by: Thomas Perrot <thomas.perrot@tupi.fr> Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
2015-12-23bind: CVE-2015-8000Sona Sarmadi
Fixes a denial of service in BIND. An error in the parsing of incoming responses allows some records with an incorrect class to be accepted by BIND instead of being rejected as malformed. This can trigger a REQUIRE assertion failure when those records are subsequently cached. [YOCTO #8838] References: http://www.openwall.com/lists/oss-security/2015/12/15/14 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8000 https://bugzilla.redhat.com/attachment.cgi?id=1105581 Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> Signed-off-by: Joshua Lock <joshua.lock@collabora.co.uk>
2015-12-18gcc-4.9: backport from gcc trunk r212178Stefan Müller-Klieser
When compiling meta-toolchain-qt5 on cortexa8, the compiler throws an internal compiler error: ... qttools-opensource-src-5.3.2/src/linguist/shared/po.cpp: In function 'bool loadPO(Translator&, QIODevice&, ConversionData&)': qttools-opensource-src-5.3.2/src/linguist/shared/po.cpp:717:1: internal compiler error: in add_stores, at var-tracking.c:6000 ... Tracking this down led to https://bugs.linaro.org/show_bug.cgi?id=534 It seems the bug is well know and fixed upstream. So backporting from trunk seems to be the right solution. This fixes the compiler problem on cortexa8 and does not seem to be very invasive. The original commit can be found at: git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/trunk@212178 138bc75d-0d04-0410-961f-82ee72b054a4 (From OE-Core master rev: 6751ef78694783fb86e55c77afefae750ab1b610) Signed-off-by: Stefan Müller-Klieser <s.mueller-klieser@phytec.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Joshua Lock <joshua.lock@collabora.co.uk>
2015-12-16feature-arm-thumb.inc: Fix ARMPKGSFX_THUMB valueMartin Jansa
* my previous thumb related commit: commit 3e760031f91fb87c3e2f62b77a117eb41164f259 Author: Martin Jansa <martin.jansa@gmail.com> Date: Wed Feb 18 15:40:35 2015 +0100 feature-arm-thumb.inc: respect ARM_INSTRUCTION_SET when adding thumb suffix unfortunately removed conditional on "thumb" in TUNE_FEATURES, when setting ARMPKGSFX_THUMB * in case we have MACHINE without "thumb" in TUNE_FEATURES and distro setting ARM_INSTRUCTION_SET to "thumb" we end with: ARM_INSTRUCTION_SET="thumb" ARM_THUMB_OPT="thumb" ARM_M_OPT="thumb" # TUNE_CCARGS correctly not adding -mthumb TUNE_CCARGS=" -march=armv7-a -mthumb-interwork -mfloat-abi=softfp -mfpu=neon" # but ARMPKGSFX_THUMB and TUNE_PKGARCH including "t2": ARMPKGSFX_THUMB="t2" TUNE_PKGARCH="armv7at2-vfp-neon" # causing following error: Error, the PACKAGE_ARCHS variable does not contain TUNE_PKGARCH (armv7at2-vfp-neon). (From OE-Core master rev: 951200673af27538beaef647a33308b4f15d1fb0) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Joshua Lock <joshua.lock@collabora.co.uk>
2015-12-08allarch: Force TARGET_*FLAGS variable valuesMike Crowe
TARGET_CPPFLAGS, TARGET_CFLAGS, TARGET_CPPFLAGS and TARGET_LDFLAGS may differ between MACHINEs. Since they are exported they affect task hashes even if unused which leads to multiple variants of allarch packages existing in sstate and bouncing in the sysroot when switching between MACHINEs. allarch packages shouldn't be using these variables anyway, so let's ensure they have a fixed value in order to avoid this problem. (Compare with 05a70ac30b37cab0952f1b9df501993a9dec70da and 14f4d016fef9d660da1e7e91aec4a0e807de59ab.) (From OE-Core master rev: d08fda21bfb7d264c238af0232a22cdd751f5150) Signed-off-by: Mike Crowe <mac@mcrowe.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Joshua Lock <joshua.lock@collabora.co.uk>
2015-12-08layer.conf: Add missing dependency for allarch package initramfs-frameworkRichard Purdie
Similiarly to the other previous changes, add a missing allarch package dependency for initramfs-framework on udev. (From OE-Core master rev: 00524d0c4449eb358dcf6c5a049a8f5371ddadee) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Joshua Lock <joshua.lock@collabora.co.uk>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-26 08:32:24 +0000