aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2016-09-23qemu: Security Fix CVE-2016-3710Armin Kuster
affects Qemu < 2.6.0 Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-09-23wget: Security fix CVE-2016-4971Armin Kuster
affects wget < 1.18.0 Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-09-23openssh: Security fix CVE-2015-8325Armin Kuster
openssh < 7.2p2 Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-09-23openssh: Security fix CVE-2016-5615Armin Kuster
openssh < 7.3 Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-09-23openssh: Security fix CVE-2016-6210Armin Kuster
affects openssh < 7.3 Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-09-23git: Security fix CVE-2016-2315 CVE-2016-2324Armin Kuster
git versions < 2.5.5 & 2.7.4 Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-09-23bind: Security fix CVE-2016-2088Armin Kuster
Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-09-23tiff: Security fix CVE-2016-5323Yi Zhao
CVE-2016-5323 libtiff: a maliciously crafted TIFF file could cause the application to crash when using tiffcrop command External References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5323 http://bugzilla.maptools.org/show_bug.cgi?id=2559 Patch from: https://github.com/vadz/libtiff/commit/2f79856097f423eb33796a15fcf700d2ea41bf31 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 4ad1220e0a7f9ca9096860f4f9ae7017b36e29e4) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2016-09-23tiff: Security fix CVE-2016-5321Yi Zhao
CVE-2016-5321 libtiff: a maliciously crafted TIFF file could cause the application to crash when using tiffcrop command External References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5321 http://bugzilla.maptools.org/show_bug.cgi?id=2558 Patch from: https://github.com/vadz/libtiff/commit/d9783e4a1476b6787a51c5ae9e9b3156527589f0 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 4a167cfb6ad79bbe2a2ff7f7b43c4a162ca42a4d) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2016-09-23tiff: Security fix CVE-2016-3186Yi Zhao
CVE-2016-3186 libtiff: buffer overflow in the readextension function in gif2tiff.c allows remote attackers to cause a denial of service via a crafted GIF file External References: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3186 https://bugzilla.redhat.com/show_bug.cgi?id=1319503 Patch from: https://bugzilla.redhat.com/attachment.cgi?id=1144235&action=diff Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 3d818fc862b1d85252443fefa2222262542a10ae) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2016-09-23libpcre: Fix CVE-2016-3191Ismo Puustinen
Fix workspace overflow for (*ACCEPT) with deeply nested parentheses. The patch is from libpcre version control at http://vcs.pcre.org/pcre?view=revision&revision=1631 with the ChangeLog part removed. Original author is Philip Hazel. Signed-off-by: Ismo Puustinen <ismo.puustinen@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 386534f968f4da376ba7778b5d436bad4ce8355b) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2016-09-23openssl: Security fix CVE-2016-2178Armin Kuster
affects openssl <= 1.0.2h CVSS v2 Base Score: 2.1 LOW Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 5b3df0c5e8885ea34f66b41fcf209a9960fbbf5e) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2016-09-23openssl: Security fix CVE-2016-2177Armin Kuster
Affects openssl <= 1.0.2h CVSS v2 Base Score: 7.5 HIGH Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 2848c7d3e454cbc84cba9183f23ccdf3e9200ec9) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2016-09-23openssl: add a patch to fix parallel buildsRoss Burton
Apply a patch taken from Gentoo to hopefully fix the remaining parallel make races. Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 3d806d59a4c5e8ff35c7e7c5a3a6ef85e2b4b259) Minor fixup to get patch to apply to jethro Signed-off-by: Armin Kuster <akuster808@gmail.com>
2016-09-02curl: security fix for CVE-2016-5421Maxin B. John
Affected versions: libcurl 7.32.0 to and including 7.50.0 Signed-off-by: Maxin B. John <maxin.john@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-02curl: security fix for CVE-2016-5420Maxin B. John
Affected versions: libcurl 7.1 to and including 7.50.0 Signed-off-by: Maxin B. John <maxin.john@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-02curl: security fix for CVE-2016-5419Maxin B. John
Affected versions: libcurl 7.1 to and including 7.50.0 Signed-off-by: Maxin B. John <maxin.john@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27perl-ptest.inc: fix tar call to prevent objcopy failureEnrico Jorns
With tar version 1.29, the tar call used to copy the ptest files will not work anymore. While the call did not match the man page (but worked) before, anyway, the latest update of tar seems to have a more strict argument handling. With the current version of the tar call, the copying of files still works with latest tar version, but the excludes will not be handled properly anymore. This results in having binaries compiled with host GCC in the package. When doing the strip_and_split files in do_package() with the target objcopy, bitbake will fail with this error: ERROR: objcopy failed with exit code 256 (cmd was [...]) [...] File format not recognized Thus, the current argument issues and required changes are: * Options must be placed _before_ the pathnames. * --exclude must be followd by a '=' in order to work properly * 'f' options is for providing an archive file, which is unnecessary in this case Note that this could also be a candidate for backporting. (From OE-Core master rev: 2e498879098f7d84610aed7961d92433083d9a02) Signed-off-by: Enrico Jorns <ejo@pengutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
2016-07-27gcc: make sure header path is set correctlyAnuj Mittal
We're setting the native header paths in do_configure_prepend, and don't need to set them again here. This results in gcc-target not being able to locate the headers and not being able to detect glibc version, which in turn results in SSP support not getting detected even though it's available in libc. (From OE-Core master rev: 85630aa894278e7818c867179dc19ca2fbd994fc) Signed-off-by: Anuj Mittal <anujx.mittal@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
2016-07-27tzdata: update to 2016eArmin Kuster
Changes affecting future time stamps Africa/Cairo observes DST in 2016 from July 7 to the end of October. Guess October 27 and 24:00 transitions. (Thanks to Steffen Thorsen.) For future years, guess April's last Thursday to October's last Thursday except for Ramadan. Changes affecting past time stamps Locations while uninhabited now use '-00', not 'zzz', as a placeholder time zone abbreviation. This is inspired by Internet RFC 3339 and is more consistent with numeric time zone abbreviations already used elsewhere. The change affects several arctic and antarctic locations, e.g., America/Cambridge_Bay before 1920 and Antarctica/Troll before 2005. Asia/Baku's 1992-09-27 transition from +04 (DST) to +04 (non-DST) was at 03:00, not 23:00 the previous day. (Thanks to Michael Deckers.) (From OE-Core master rev: ddcf128e76ed0678ce42416531f4ecb309c57439) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
2016-07-27tzcode: update to 2016eArmin Kuster
V2: typo in title (jet lagged) Changes to code zic now outputs a dummy transition at time 2**31 - 1 in zones whose POSIX-style TZ strings contain a '<'. This mostly works around Qt bug 53071 <https://bugreports.qt.io/browse/QTBUG-53071>. (Thanks to Zhanibek Adilbekov for reporting the Qt bug.) Changes affecting documentation and commentary tz-link.htm says why governments should give plenty of notice for time zone or DST changes, and refers to Matt Johnson's blog post. tz-link.htm mentions Tzdata for Elixir. (Thanks to Matt Johnson.) (From OE-Core master rev: 5f3340e5c966f4233e0cd4ec468b20a1fd5a7346) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
2016-07-27wic: fix path parsing, use last occurrenceGeorge McCollister
If the path contains 'scripts' more than once the first occurrence will be incorrectly used. Use rfind instead of find to find the last occurrence. Signed-off-by: George McCollister <george.mccollister@gmail.com>
2016-07-27bluez5: move btmgmt to common READLINE sectionNicolas Dechesne
Upstream in 5.33 btmgmt was moved from experimental to common READLINE section, in commit e4f0c5582f1fe3451d5588243adba9de1ed68b80, but this was never updated in the recipe. This is a backport from master branch, commit 28777e593d3dd3a5d0ee2effcdca6a971e2887f9. Signed-off-by: Nicolas Dechesne <nicolas.dechesne@linaro.org>
2016-07-27libxml2: Security fix for CVE-2016-4448Armin Kuster
Affects libxml2 < 2.9.4 Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-07-27libxml2: Security fix for CVE-2016-4447Armin Kuster
Affects libxml2 < 2.9.4 Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-07-27libxml2: Security fix for CVE-2016-3627Armin Kuster
Affects libxml2 < 2.9.4 Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-07-27libxml2: Security fix for CVE-2016-1833Armin Kuster
Affects libxml2 < 2.9.4 Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-07-27libxml2: Security fix for CVE-2016-1835Armin Kuster
Affects libxml2 < 2.9.4 Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-07-27libxml2: Security fix for CVE-2016-1837Armin Kuster
Affects libxml2 < 2.9.4 Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-07-27libxml2: Security fix for CVE-2016-4449Armin Kuster
Affects limbxml2 < 2.9.4 Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-07-27libxml2: Security fix for CVE-2016-1836Armin Kuster
Affects libxml2 < 2.9.4 Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-07-27libxml2: Security fix for CVE-2016-1839Armin Kuster
Affects libxml2 < 2.9.4 Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-07-27libxml2: Security fix for CVE-2016-1838Armin Kuster
Affects libxml2 < 2.9.4 Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-07-27libxml2: Security fix for CVE-2016-1840Armin Kuster
affects libxml2 < 2.9.4 Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-07-27libxml2: Security fix for CVE-2016-4483.patchArmin Kuster
affects libxml2 < 2.9.4 Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-07-27libxml2: Security fix for CVE-2016-1834.patchArmin Kuster
Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-07-27libxml2: Security fix for CVE-2016-3705Armin Kuster
Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-07-27libxml2: Security fix for CVE-2016-1762Armin Kuster
Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-07-27glibc: Security fix for CVE-2016-4429Armin Kuster
Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-07-27glibc: Security Fix for CVE-2016-3706Armin Kuster
Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-06-03toasterconf.json: exclude releases Toaster can't buildpython3-pycairoElliot Smith
Due to changes in master to support Python 3, Toaster is no longer able to build from master. Remove references to master and set default release to jethro. The dizzy release should also be removed, as Toaster jethro is unable to build using this release. Signed-off-by: Elliot Smith <elliot.smith@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-24wic: insert local Python paths at frontMatt Madison
This follows how bitbake performs path insertion, and fixes a failure to start wic on Ubuntu 15.10 with the distribution's version of python-ply installed. Signed-off-by: Matt Madison <matt@madison.systems> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-23build-appliance-image: Update to jethro head revisionRichard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-23build-appliance-image: Update to jethro head revisionRichard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-22gdb: Backport patch to changes with AVX and MPXSaul Wold
The current MPX target descriptions assume that MPX is always combined with AVX, however that's not correct. We can have machines with MPX and without AVX; or machines with AVX and without MPX. This patch adds new target descriptions for machines that support both MPX and AVX, as duplicates of the existing MPX descriptions. The following commit will remove AVX from the MPX-only descriptions. This commit is backported from 7.12 Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-17gcc: Security Fix CVE-2016-4490Armin Kuster
Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-05-17gcc: Security fix CVE-2016-2226Armin Kuster
Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-05-17gcc: Security fix CVE-2016-4489Armin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2016-05-17gcc: Security fix CVE-2016-4488Armin Kuster
Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-05-14openssl: prevent ABI break from earlier jethro releasesJoshua Lock
The backported upgrade to 1.0.2h included an updated GNU LD version-script which results in an ABI change. In order to try and respect ABI for existing binaries built against fido this commit partially reverts the version-script to maintain the existing ABI and instead only add the new symbols required by 1.0.2h. Suggested-by: Martin Jansa <martin.jansa@gmail.com> (From OE-Core rev: 480db6be99f9a53d8657b31b846f0079ee1a124f) Signed-off-by: Joshua Lock <joshua.g.lock@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-24 07:01:05 +0000