aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2017-08-23libcheck: fix file-rdeps QA issueMartin Jansa
* Fixes: ERROR: nativesdk-libcheck-0.10.0-r0 do_package_qa: QA Issue: /usr/local/oecore-x86_64/sysroots/x86_64-oesdk-linux/usr/bin/checkmk contained in package nativesdk-libcheck requires /usr/local/oecore-x86_64/sysroots/x86_64-oesdk-linux/usr/bin/gawk, but no providers found in RDEPENDS_nativesdk-libcheck? [file-rdeps] Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-23squashfs: fix build with glibc-2.26Martin Jansa
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-23apt: Upgrade to 1.2.24Aníbal Limón
Add new patches for enable builds on hosts that has GCC version minor than 5 because doesn't support std::array and std::put_time, those patches could be removed after get rid of Debian8 and Centos7 support. - gcc_4.x_Revert-avoid-changing-the-global-LC_TIME-for-Release.patch - gcc_4.x_Revert-use-de-localed-std-put_time-instead-rolling-o.patch - gcc_4.x_apt-pkg-contrib-strutl.cc-Include-array-header.patch The LIC_FILES_CHKSUM changed because the license file now has style changes in the text remains GPLv2+. The patch Revert-always-run-dpkg-configure-a-at-the-end-of-our was updated because now the precision fields use floating point numbers. Signed-off-by: Aníbal Limón <anibal.limon@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-23dpkg: Upgrade to 1.18.24Aníbal Limón
Patches rebased due to don't apply, no major changes, - 0002-Adapt-to-linux-wrs-kernel-version-which-has-characte.patch - arch_pm.patch - noman.patch Patches related to move ostable/triplettable insida data/ostable and data/tupletable instead also needs to comply the new format of the tables for arch detection. - 0006-add-musleabi-to-known-target-tripets.patch - add_armeb_triplet_entry.patch And finally a patch to avoid usage --clamp-mtime in tar needs to be modified because the dpkg-deb internal API changed. - 0007-dpkg-deb-build.c-Remove-usage-of-clamp-mtime-in-tar.patch Signed-off-by: Aníbal Limón <anibal.limon@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-23strace: 4.17 -> 4.18Robert Yang
- Updated update-gawk-paths.patch. - Updated Makefile-ptest.patch - Removed 0008-replace-struct-ucontext-with-ucontext_t.patch which is already in the source. - The LIC_FILES_CHKSUM is changed because the years have been updated, the contents are the same. Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-23e2fsprogs: 1.43.4 -> 1.43.5Robert Yang
Removed the following 2 patches which are already in the source: - 0001-e2fsck-exit-with-exit-status-0-if-no-errors-were-fix.patch - e2fsprogs-1.43-sysmacros.patch Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-23tcl: 8.6.6 -> 0.8.7Robert Yang
Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-23libbsd: 0.8.5 -> 0.8.6Robert Yang
Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-23git: 2.13.2 -> 2.13.3Robert Yang
Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-23kernel-module-split: rrecommend kernel-image instead of rdependMartin Hundebøll
Hard depending on the kernel makes it impossible to install kernel modules without getting the kernel image installed too. This is inconvenient in e.g. initramdisks, where the kernel is loaded from outside the initramdisk. Making the kernel modules rrecommend kernel-image-<version> instead of rdepending on it, makes it possible to install kernel modules without the kernel image by setting "kernel-image" in BAD_RECOMMENDATIONS. Signed-off-by: Martin Hundebøll <mnhu@prevas.dk> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-23connman: Fix for CVE-2017-12865Sona Sarmadi
dnsproxy: Fix crash on malformed DNS response If the response query string is malformed, we might access memory pass the end of "name" variable in parse_response(). [YOCTO #11959] Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-23gnupg: 2.1.20 -> 2.1.23Hongxu Jia
1. COPYING.LIB: Rename to COPYING.LGPL3. https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=3419a339d9c4e800bf30e9021e05982d8c1021c1 2. Rebase patches: - pkgconfig.patch -> 0001 - use-pkgconfig-instead-of-npth-config.patch -> 0002 - dirmngr-uses-libgpg-error.patch -> 0003 - autogen.sh-fix-find-version-for-beta-checking.patch -> 0004 3. Fix gpg2 not found ... dnf -vy makecache |Cannot download 'http://192.168.7.1:33541': repomd.xml GPG signature verification error: gpgme_engine_check_version() error: Invalid crypto engine. ... The upstream install gpg by default and no gpg2 ... commit a69464b0b6dac88b360a13d3faf19dd7f2a0e02b Author: Werner Koch <wk@gnupg.org> Date: Sat Aug 5 14:39:32 2017 +0200 gpg: Install gpg by default under the name gpg. ... Add --enable-gpg-is-gpg2 to revert it. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-21gdk-pixbuf: fix ptest RDEPENDS for multilib buildWenzong Fan
Don't hardcode the package name, it could be gdk-pixbuf or lib32-gdk-pixbuf. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-21recipetool: allow plugins to set LICENSE and LIC_FILES_CHKSUMPaul Eggleton
We were being a bit prescriptive in setting LICENSE and LIC_FILES_CHKSUM. We can't always trust what's in the metadata accompanying some source which plugins will almost always be pulling from, however we do want to allow plugins to set the LICENSE and LIC_FILES_CHKSUM values. Merge what we find in our license file scan with what the plugin sends back. Additionally, plugins can now add a "license" item to the handled list in order to inhibit the normal LICENSE / LIC_FILES_CHKSUM handling if they have already taken care of it completely. Thanks to Mark Horn <mark.d.horn@intel.com> for prompting, testing and fixing this patch. Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-21recipetool: allow plugins to set PN / PV more easilyPaul Eggleton
Previously if we were able to auto-determine the name from the URL, that took precedence over any name that might be set in extravalues by a plugin. Some plugins might be able to get a better idea of the name and thus we should move defaulting of the name further down after the plugins have had a chance to set it. Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-21devtool: import: new plugin to import the devtool workspaceLeonardo Sandoval
Takes a tar archive created by 'devtool export' and imports (untars) it into the workspace. Currently the whole tar archive is imported, there is no way to limit what is imported. https://bugzilla.yoctoproject.org/show_bug.cgi?id=10510 [YOCTO #10510] Signed-off-by: Leonardo Sandoval <leonardo.sandoval.gonzalez@linux.intel.com> Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-21devtool: append md5sum only if not already presentLeonardo Sandoval
In case the proposed md5sum to be appended to the .devtool_md5 file is already present, do not append it. Signed-off-by: Leonardo Sandoval <leonardo.sandoval.gonzalez@linux.intel.com> Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-21devtool: export: new plugin to export the devtool workspaceLeonardo Sandoval
By default, exports the whole workspace (all recipes) including the source code. User can also limit what is exported with --included/--excluded flags. As a result of this operation, a tar archive containing only workspace metadata and its corresponding source code is created, which can be properly imported with 'devtool import'. https://bugzilla.yoctoproject.org/show_bug.cgi?id=10510 [YOCTO #10510] Signed-off-by: Leonardo Sandoval <leonardo.sandoval.gonzalez@linux.intel.com> Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-21devtool: upgrade: enable branch checking when revision is providedChang Rebecca Swee Fun
When devtool upgrade is run on a recipe with revision specified that is not on master branch, and branch isn't set by --srcbranch or -B, then we should get the correct branch and append the branch to the URL. If the revision was found on multiple branches, we will display error to inform user to provide a correct branch and exit. [YOCTO #11484] Signed-off-by: Chang Rebecca Swee Fun <rebecca.swee.fun.chang@intel.com> Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-21recipetool: create: replacing PV in SRCURIStanley Phoong
During recipe creation, it seems that the automation for replacing ${PV} at the SRCURI for tag, (e.g mbed-tls-${PV}) is causing some issue due to PV assuming it's a git source. A fix is implemented in this patch to resolve this issue. Signed-off-by: Stanley Phoong <stanley.cheong.kwan.phoong@intel.com> Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-21recipetool: create: handle git URLs specifying only a tagStanley Phoong
If a git URL is passed to recipetool create with a tag=, recipetool should handle it assuming that the tag is valid. [YOCTO #11393] Signed-off-by: Stanley Phoong <stanley.cheong.kwan.phoong@intel.com> Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-21recipetool: create: being able to set branch when revision is providedChang Rebecca Swee Fun
This change is to improve the buildability of the recipe created by recipetool and devtool. When recipetool create is run on a git URL and a revision specified that is not on master, and "branch=" isn't already in the URL, then we should get the correct branch and append the branch to the URL. If the revision was found on multiple branches and 'master' is not in the list, we will display error to inform user to provide a correct branch and exit. [YOCTO #11389] Signed-off-by: Chang Rebecca Swee Fun <rebecca.swee.fun.chang@intel.com> Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-21recipetool: create: disable PREMIRRORS and MIRRORS by defaultChang Rebecca Swee Fun
When creating new recipes, we are almost certainly fetching a new source rather that something that has already been fetched. I have disable PREMIRRORS and MIRRORS settings in the recipe that created by devtool while leaving an option for users to enable them manually if needed. Since devtool already has this options, we need to ensure that recipetool is able to handle the options passed from devtool. Signed-off-by: Chang Rebecca Swee Fun <rebecca.swee.fun.chang@intel.com> Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-19devtool/copy_buildsystem: adds meta-skeleton layer in the eSDK installation.Juan M Cruz Alcaraz
The eSDK installation requires the meta-skeleton layer. The build system might use the meta-skeleton recipes as layout to create custom recipes. An example is the recipetool script that uses the meta-skeleton kernel recipe when creating a custom kernel recipe. [YOCTO #11102] Signed-off-by: Juan M Cruz Alcaraz <juan.m.cruz.alcaraz@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-19initramfs-framework/setup-live: also boot live image if root=/dev/ram0California Sullivan
Our grub and syslinux bootloaders both define root=/dev/ram0 for live images by default. Kernel docs show that root=/dev/ram0 is just a sentinel value for the kernel to mount the initrd as root, which then mounts and switches to the real root. This is exactly what our scripts do, so just check for root=/dev/ram0 as well. See: https://www.kernel.org/doc/html/v4.11/admin-guide/initrd.html#operation This fixes the issue where the new initramfs-framework scripts would not boot live images that use grub or syslinux bootloaders. Signed-off-by: California Sullivan <california.l.sullivan@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-19openssl10: rename back to openssl and make it the default via PREFERRED_VERSIONAlexander Kanavin
openssl 1.1 broke 3rd party layers a lot more than was expected; let's flip the switch at the start of next development cycle. Add a PROVIDES = "openssl10" to openssl 1.0 recipe; any dependency that is not compatible with 1.1 should use that in its DEPENDS, as the 1.0 recipe will later be renamed back to openssl10. This does not always work: http://lists.openembedded.org/pipermail/openembedded-core/2017-August/140957.html but for many recipes it does. Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-19prelink: Change the behavior to avoid checking USER_CLASSESMark Hatle
The behavior before this change was to check USER_CLASSES and adjust the install script to return either exit 0 (don't do anything) or exit 1 (run on first boot). This enabled a user to include the prelink package without enablign the image-prelink bbclass and get a first boot prelink. Checking USER_CLASSES is not desired, as an image should be able to simply inherit the image-prelink and get the same type of behavior. Modifying the recipe based on the inclusion of a class is a bad idea as it makes this style work more difficult. So we move to a more defined strategy based on exist uses. (That we know of...) If we ae doing a cross install, we want to avoid prelinking. Prelinking during a cross install should be handled by the image-prelink bbclass. If the user desires this to run on the target at first boot they will need to create a custom boot script. [YOCTO #11169] Signed-off-by: Mark Hatle <mark.hatle@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-19qemu conf: replace deprecated option with new optionChen Qi
Replace the deprecated '-usbdevice' option with '-device usb-xx' option. This would fix runqemu boot error like below. '-usbdevice' is deprecated, please use '-device usb-...' instead Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-19qemu: backport patches to fix boot failureChen Qi
Backport two patches to fix the following error when booting qemu. Failed to unlock byte 100 Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-19ruby: fix CVE-2017-922{6-9}Joe Slater
CVE-2017-9226 : check too big code point value for single byte CVE-2017-9227 : access to invalid address by reg->dmin value CVE-2017-9228 : invalid state(CCS_VALUE) in parse_char_class() CVE-2017-9229 : access to invalid address by reg->dmax value Signed-off-by: Joe Slater <jslater@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-18dnf: fix "Unable to detect release version" warningAlexander Kanavin
The release version was actually working correctly; it only makes the warning work properly. Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-18cve-check-tool: Fix progress bar patch for curl 7.55Jussi Kukkonen
CURL_FORMAT_OFF_T does not seem to exist anymore, use CURL_FORMAT_CURL_OFF_T instead. This works with old and new curl. Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-18mesa: update to 17.1.6Andreas Müller
Optional installation of khrplatform.h was implemented upstream by a slightly different approach -> 0001-mapi-Only-install-khrplatform.h-with-EGL-or-GLES.patch can be removed. Signed-off-by: Andreas Müller <schnitzeltony@googlemail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-18webkitgtk: Add a recommends on shared-mime-info.Carlos Alberto Lopez Perez
* without this package installed any WebKitGTK+ based browser will fail to correctly open html files (and other files) from disk (file:// URIs). It will open them as plain txt files. Signed-off-by: Carlos Alberto Lopez Perez <clopez@igalia.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-18mpg123: upgrade to 1.25.6Dengke Du
Signed-off-by: Dengke Du <dengke.du@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-18oeqa: increase verbosity of dnf commands in dnf packagefeed testMarkus Lehtonen
Makes diagnosing failures easier. [YOCTO #11209] Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-18perl: Don't change /usr/include references in docs to sysroot pathsOoi Cinly
do_configure() will no longer convert references to /usr/include into /path/to/recipes-sysroot/usr/include for the file "Porting/Glossary". [YOCTO #11243] Signed-off-by: Ooi Cinly <cinly.ooi@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-18libtool: remove /absolute/path/to/host referencesOoi Cinly
Removed all instances of -fdebug-prefix-map in LTCFLAGS declaration because they contain references to host system and are not needed. /absolute/path/to/host/dd was replaced with 'dd' in lt_truncate_bin declaration. Please take note that the location of regex is important for DEBUG_PREFIX_MAP. Removal of DEBUG_PREFIX_MAP has to be done before other regex command modify its option value. Both are modified because they affect binary reproducibility. [YOCTO #11656] Signed-off-by: Ooi Cinly <cinly.ooi@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-18valgrind: disable build for muslx32sweeaun
Disable build for muslx32.X32 isn't supported by valgrind at this moment. Signed-off-by: sweeaun <swee.aun.khor@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-18goarch: Disable build for muslx32sweeaun
Disable build for muslx32. Signed-off-by: sweeaun <swee.aun.khor@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-18openssl10: modified the define cryptodevHuang Qiyu
Use PACKAGECONFIG to add cryptodev. Signed-off-by: Huang Qiyu <huangqy.fnst@cn.fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-18mesa: Fix build with llvmpipe enabled on muslKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-18rootfs-postcommands.bbclass: Filter out dangling symlinks in ↵Khem Raj
ssh_allow_empty_password() In images built with pam in DISTRO_FEATURES, we end up with dangling symlinks if su is not packaged into image $ ls /mnt/a/oe/build/tmp/work/raspberrypi3-bec-linux-gnueabi/core-image-minimal/1.0-r0/rootfs/etc/pam.d/su-l -l lrwxrwxrwx 1 kraj users 2 Aug 9 07:56 /mnt/a/oe/build/tmp/work/raspberrypi3-bec-linux-gnueabi/core-image-minimal/1.0-r0/rootfs/etc/pam.d/su-l -> su This causes image do_rootfs to fail | sed: can't read /mnt/a/oe/build/tmp/work/raspberrypi3-bec-linux-gnueabi/core-image-minimal/1.0-r0/rootfs/etc/pam.d/s u-l: No such file or directory | WARNING: /mnt/a/oe/build/tmp/work/raspberrypi3-bec-linux-gnueabi/core-image-minimal/1.0-r0/temp/run.ssh_allow_empty_ password.19238:1 exit 2 from 'sed -i 's/nullok_secure/nullok/' /mnt/a/oe/build/tmp/work/raspberrypi3-bec-linux-gnueabi /core-image-minimal/1.0-r0/rootfs/etc/pam.d/*' Therefore we need to filter out dangling symlinks before sed'ing things out Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-18cairo: Fix CVE-2017-9814Dengke Du
Backport patch from the following link to fix CVE-2017-9814: https://bugs.freedesktop.org/show_bug.cgi?id=101547 Signed-off-by: Dengke Du <dengke.du@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-18libsndfile1: Fix CVE-2017-8363Jackie Huang
Backport the patch to fix CVE-2017-8363: The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file. Reference: https://nvd.nist.gov/vuln/detail/CVE-2017-8363 Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-18libsndfile1: Fix CVE-2017-8362Jackie Huang
Backport the patch to fix CVE-2017-8362: The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted audio file. Reference: https://nvd.nist.gov/vuln/detail/CVE-2017-8362 Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-18libsndfile1: Fix CVE-2017-8361 and CVE-2017-8365Jackie Huang
Backport the patch to fix two CVEs: CVE-2017-8361: The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file. CVE-2017-8365: The i2les_array function in pcm.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file. Reference: https://nvd.nist.gov/vuln/detail/CVE-2017-8361 https://nvd.nist.gov/vuln/detail/CVE-2017-8365 Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-18wget: Security fix CVE-2017-6508Yi Zhao
CVE-2017-6508: CRLF injection vulnerability in the url_parse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in the host subcomponent of a URL. External References: https://nvd.nist.gov/vuln/detail/CVE-2017-6508 Patch from: http://git.savannah.gnu.org/cgit/wget.git/commit/?id=4d729e322fae359a1aefaafec1144764a54e8ad4 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-18xserver-xorg: Fix CVE-2017-10971Jackie Huang
Backport 3 patches to fix CVE-2017-10971: In the X.Org X server before 2017-06-19, a user authenticated to an X Session could crash or execute code in the context of the X Server by exploiting a stack overflow in the endianness conversion of X Events. Reference: https://nvd.nist.gov/vuln/detail/CVE-2017-10971 Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-18rootfs-postcommands.bbclass: Prevent linking testdata to itselfMike Looijmans
testdata and testdata_link may point to the same file, in particular when IMAGE_LINK_NAME and IMAGE_NAME are equal. Check if this is the case before creating a symlink that points to itself and makes the next build fail. Signed-off-by: Mike Looijmans <mike.looijmans@topic.nl> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-05-26 04:32:14 +0000