summaryrefslogtreecommitdiffstats
path: root/meta/recipes-extended
AgeCommit message (Collapse)Author
2020-03-20screen: fix CVE-2020-9366Anuj Mittal
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-03-16libarchive: Fix CVE-2020-9308Wenlin Kang
Fix CVE-2020-9308 Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-02-19Revert "bash: Fix CVE-2019-18276"Anuj Mittal
This reverts commit 09e695246d30ef9b73e743e0130e710e19793d14. This isn't a Backport as indicated in patch and not all the changes in this change are relevant to the CVE. Revert and wait for the fix to be available upstream. Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-11sudo: specify where target tools areRoss Burton
sudo uses AC_PATH_PROG to find target paths, which means at best potential host-contamination (and reproducible issues) and at worst it thinks sh is at /your/build/path/hosttools/sh. Solve this by explicitly passing the correct paths to configure. (From OE-Core rev: 61650dd8498a093f3bfa93202c9cd2e9a7fb7834) (From OE-Core rev: 6e809474ab686fba6924d8b46fd0b9eab5c66c06) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-11iputils: Fix build determinismRichard Purdie
The suid/setcap code depends on whether setcap is on the host system or not with suid as a fallback. Disable this functionality to be deterministic. (From OE-Core rev: 8b00ec484fb851c301f13145e17707c0167feab1) (From OE-Core rev: 3997c47dea49d583fd48cb03f83c007f61d2cb35) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-11libidn2: Fix reproducibility issueRichard Purdie
The previous tweak for reproducibility didn't handle the duplicate whitepace left behind, fix this. [YOCTO #13771] (From OE-Core rev: 0392fcbdc85180581ce7392212808ebb822cc2e8) (From OE-Core rev: ca213de432d8d9d715ef09e17cea2aa1e6666e91) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-11tar: Fix build determinism, disable rshRichard Purdie
rsh is insecure and obsolete but tar will enable support if the binary is on the host system. Some systems point it at ssh. Lets explictly disable it for now unless someone actually needs/uses this at which point it could become a packageconfig. (From OE-Core rev: d14a4b0db92a9a7d1ff72a2e0faca7f1a23a0b68) (From OE-Core rev: 6bdc5f787af46e9c849947cad06ad40aa401b767) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-11mc: Fix manpage date indeterminismRichard Purdie
The man page date can vary depending upon the host perl, e.g. in Russian some versions print 'июня', others 'Июнь' or Polish 'czerwca' or 'czerwiec'. Rather than depend upon perl-native to fix this, just remove the date from the manpages. (From OE-Core rev: 5553c20f9fa4f35bf711b6b9d5717dcf4bfefafa) (From OE-Core rev: 3653fd41fbc28f70259a00bb0098ec8731526449) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-11mc: Set zipinfo presence determinsticallyRichard Purdie
This value was floating causing differences in generated files. Set it determinstically. (From OE-Core rev: 11d7a9e37c1d3fc21396a98fefc9d34c0b9e784b) (From OE-Core rev: 8f77075425e2ef9c3b5adbf8e5b29e7cfd7b9b7a) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-11mc: Fix build reproducibilityJoshua Watt
Fixes some issues with reproducible builds. Adds a patch to allow the configure arguments to be omitted from the build and also explicitly setting some autoconf paths that were picking up hosttools. (From OE-Core rev: f54d60ee8f15229aa515e168b9c7d248663b48fe) (From OE-Core rev: 164d72b7a6ab20940f9a124beaf485be9ddc07ba) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-11sudo: Set vardir deterministicallyRichard Purdie
Without setting this it will vary depending on which directories are present on the host. [YOCTO #13775] (From OE-Core rev: 39fe849b56d70689846262c31ab7c182c8443923) (From OE-Core rev: 51274c9b195ad00dd6362f352ad9bbf7e9a3e098) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-11cpio: fix CVE-2019-14866Anuj Mittal
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-02-11Revert "bzip2: Fix CVE-2019-12900"Anuj Mittal
This reverts commit 175e6cb75ce328d51a9d4ad18c7e09d9fb92c2e1. This change is already in bzip2 1.0.7. The change fixing a regression caused by this change is in 1.0.8 which is the current version in zeus. This isn't resulting in failures because the patch file isn't included in SRC_URI. Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-02-04core: recipes: fix some native tools dependenciesSumit Garg
Some native tools dependency issues were seen while building with external GCC tool-set rather than source GCC tool-set. While building with source tool-set these dependencies were implicitly met which is not the case with external tool-set. So explicitly state these native tools dependencies. Signed-off-by: Sumit Garg <sumit.garg@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-04bzip2: Fix CVE-2019-12900Sana Kazi
Added patch for CVE-2019-12900 as backport from upstream. Fixes out of bound access discovered while fuzzying karchive. Tested by: Sana.Kazi@kpit.com Signed-off-by: Saloni Jain <Saloni.Jain@kpit.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-04bash: Fix CVE-2019-18276De Huo
An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected. Backport the CVE patche from https://github.com/bminor/bash/commit/ 951bdaad7a18cc0dc1036bba86b18b90874d39ff to fix CVE-2019-18276 Signed-off-by: Chet Ramey <chet.ramey@case.edu> Signed-off-by: De Huo <De.Huo@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-12-31sysstat: fix CVE-2019-19725Anuj Mittal
(From OE-Core rev: 2bf6fdc460526feb0955b3b789e7be78f6e8ec4a) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-12-16recipes: change SRC_URI to use httpsStefan Müller-Klieser
Change all recipes to https where we get an http 301 permanent redirect. (From OE-Core rev: e514acda9e12bccde6d3974e0fd1a37b3837191a) Signed-off-by: Stefan Müller-Klieser <s.mueller-klieser@phytec.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-12-16Revert "libtirpc: create the symbol link for rpc header files"Peter Kjellerstedt
This reverts commit 0b9748c655b6f733b504e70288f4b91dca2e4d58. The headers provided by libtirpc are not drop in replacements for the RPC header files previously provided by glibc, so do not install them as if they were. Additionally, they clash with the header files installed by glibc if an older version of glibc is used. Any problems related to the lack of the old header files from glibc should be addressed in the application/library that expects them. Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-12-06libarchive: fix CVE-2019-19221Anuj Mittal
Also see: https://github.com/libarchive/libarchive/issues/1276 (From OE-Core rev: 422bef7a205b9b5d48d5b0e0b2b14ac65484607a) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2019-12-06ghostscript: fix for CVE-2019-14811 is same as CVE-2019-14813Anuj Mittal
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14813 https://www.openwall.com/lists/oss-security/2019/08/28/2 (From OE-Core rev: afef29326b4332fc87c53a5d9d43288cddcdd944) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2019-12-06ghostscript: CVE-2019-14869Stefan Ghinea
A flaw was found in all versions of ghostscript 9.x before 9.28, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges within the Ghostscript and access files outside of restricted areas or execute commands. References: https://nvd.nist.gov/vuln/detail/CVE-2019-14869 Upstream patches: https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904 (From OE-Core rev: 0bb88ac63b4e1728373c6425477a32f7a6362b2c) Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2019-11-25core-image-full-cmdline: Add lessRichard Purdie
Less was coming from busybox in these images, add the full version. [YOCTO #13630] Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-19iputils: Whitelist CVE-2000-1213 CVE-2000-1214Adrian Bunk
(From OE-Core rev: 9fea7c3fae30bb1eecb31ec3bf777db981dc1eed) Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-19sysstat: Correct when to use the package provided systemd unit filesPeter Kjellerstedt
There have been a number of changes back and forth as to when and how to use the systemd unit files provided by the package. The correct condition is actually that both cron and systemd need to be enabled for them to be installed. (From OE-Core rev: d6c975160197f67937dfbe91b08100b0f597c589) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-19sysstat: Correct our systemd unit filePeter Kjellerstedt
In commit 8862f21e (sysstat: 12.1.3 -> 12.1.6), sa_lib_dir was changed from "${libdir}/sa" to "${libexecdir}/sa" to avoid problems with multilib. However, the systemd unit file was not changed accordingly, which lead to the following error when trying to start the service: systemd[4698]: sysstat.service: Failed at step EXEC spawning /usr/lib/sa/sa1: No such file or directory (From OE-Core rev: 0fd691b9801b5313ff2e2c2cd5ca13fd50063235) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-10libtirpc: create the symbol link for rpc header filesZhixiong Chi
Since the Sun RPC is deprecated in glibc, the rpc header files are not provided any more, but it allows alternative RPC implementations, such as TIRPC or rpcsvc-proto, to be used. So we create the symbol link for rpc header files for tirpc to be more compatible with the glibc version and the application usage. Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-11-10ltp: Fix overcommit_memory failureHe Zhe
Backport a patch from upstream to fix the following runtime failure. mem.c:814: INFO: set overcommit_memory to 0 overcommit_memory.c:213: FAIL: alloc passed, expected to fail Signed-off-by: He Zhe <zhe.he@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-11-10mdadm: fix do_package failed when changed local.conf but not cleanedChangqing Li
reproduce steps: 1. add DISTRO_FEATURE_append = 'usrmerge' in local.conf 2. bitbake mdadm --success 3. remove DISTRO_FEATURE_append = 'usrmerge' from local.conf 4. bitbake mdadm -- failed when do_package it is not proper to change source Makefile during do_install by sed, fix by pass correct config to EXTRA_OEMAKE [YOCTO #13493] Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-11-10sudo: Fix fetching sourcesFerry Toth
It looks like https://www.sudo.ws/download.html changed certificate and directory structure. This breaks fetching sources. Signed-off-by: Ferry Toth <ftoth@exalondelft.nl> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-11-10libpam: set CVE_PRODUCTRoss Burton
Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2019-11-10procps: whitelist CVE-2018-1121Ross Burton
This CVE is about race conditions in 'ps' which make it unsuitable for security audits. As these race conditions are unavoidable ps shouldn't be used for security auditing, so this isn't a valid CVE. Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2019-10-29sudo: fix CVE-2019-14287Changqing Li
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command. Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4e11cd561f2bdaa6807cf02ee7c9870881826308) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-25sysstat: fix CVE-2019-16167Wenlin Kang
This commit is another part of CVE-2019-16167, please see https://github.com/sysstat/sysstat/issues/232. Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 586c045eb81b79200b46bf743f5d3fdb5f68c12d) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-08ghostscript: Disable libpaperKhem Raj
OE does not provide libpaper recipe, and the configure check looks for libpaper if not disabled, this causes problems especially when shared state is built on a machine which has libpaper installed on host but the consumer machine although running same OS, but does not have libpaper installed, the artifact from sstate are re-used but then native binary ./obj/aux/packps fails to execute ./obj/aux/packps: error while loading shared libraries: libpaper.so.1: cannot open shared object file: No such file or directory So either we need to provide libpaper in OE or we disable it, disabling is best for now Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-10-08watchdog: fix PIDFile path in existing patchTrevor Gamblin
systemd throws a warning about the value of PIDFile: systemd[1]: /usr/lib/systemd/system/watchdog.service:11: PIDFile= references a path below legacy directory /var/run/, updating /var/run/watchdog.pid → /run/watchdog.pid; please update the unit file accordingly. This is actually due to patch file 0001-watchdog-remove-interdependencies-of-watchdog-and-wd.patch setting PIDFile=/var/run/watchdog.pid. Modify PIDFile in the patch to be correctly set to /run/watchdog.pid. Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-10-07ethtool, libcap: fix upstream version checkAlexander Kanavin
The default URI returns a gzip-compressed index page which browsers can auto-detect, but we can't. Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-10-02ltp: Fix hang of cve test casesHe Zhe
Backport a patch to the fix possible hang caused by the case of CVE-2017-17052. CVE: CVE-2017-17052 Signed-off-by: He Zhe <zhe.he@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2019-10-02shadow: use relaxed usernames for allLi Zhou
The previous commit <shadow: use relaxed usernames> works only for target. When test with configuration: INHERIT += 'extrausers' EXTRA_USERS_PARAMS += "useradd -p '' aBcD; " and run "bitbake core-image-minimal", error occurs: NOTE: core-image-minimal: Performing useradd with [ -R .../build/tmp-glibc/work/qemux86_64-wrs-linux/core-image-minimal/1.0-r0/rootfs -p '' aBcD] useradd: invalid user name 'aBcD' Here move the patch for using relaxed usernames from class_target to the source code for all. Signed-off-by: Li Zhou <li.zhou@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2019-09-27unzip: Fix CVE-2019-13232Dan Tran
Signed-off-by: Dan Tran <dantran@microsoft.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-09-27lighttpd: remove fam as a PACKAGECONFIG optionTrevor Gamblin
lighttpd builds fail if "fam" (and therefore gamin) is enabled. In conf/local.conf: CORE_IMAGE_EXTRA_INSTALL += "lighttpd" PACKAGECONFIG_append_pn-lighttpd = " fam" bitbake error: ERROR: Nothing PROVIDES 'gamin' (but /yow-lpggp31/tgamblin/oe-core.git/meta/recipes-extended/lighttpd/lighttpd_1.4.54.bb DEPENDS on or otherwise requires it) NOTE: Runtime target 'lighttpd' is unbuildable, removing... Missing or unbuildable dependency chain was: ['lighttpd', 'gamin'] ERROR: Required build target 'core-image-minimal' has no buildable providers. Missing or unbuildable dependency chain was: ['core-image-minimal', 'lighttpd', 'gamin'] Since gamin hasn't been maintained for several years, this should be removed from the list of lighttpd PACKAGECONFIG options. --without-fam is hard-coded in EXTRA_OECONF for good measure. Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-09-27net-tools: Fix installed-vs-shipped for nativesdkRobert Yang
Fixed: $ bitbake nativesdk-net-tools ERROR: nativesdk-net-tools-1.60-26-r0 do_package: QA Issue: nativesdk-net-tools: Files/directories were installed but not shipped in any package: /usr /usr/share /usr/share/man [snip] Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-09-19tzdata: Correct the packaging of /etc/localtime and /etc/timezonePeter Kjellerstedt
During restructuring of the packaging in 2af4d6eb (tzdata: Install everything by default), these two files remained in the tzdata package, which is supposed to be empty. Move them to tzdata-core where they belong. Also simplify the definition of CONFFILES_tzdata-core. As its value only takes effect for files that actually exist, there is no need to complicate its definition by checking if a file is created before adding it to the list of configuration files. Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-09-19acpica: upgrade 20190509 -> 20190816Ross Burton
Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-09-16iptables: add systemd helper unit to load/restore rulesJack Mitchell
There is currently no way to automatically load iptables rules in OE. Add a systemd unit file to automatically load rules on network connection. This is cribbed from the way ArchLinux handles iptables with some minor modifications for OE. New rules can be generated directly on the target using: # iptables-save -f /etc/iptables/iptables.rules Good documentation for writing rules offline is lacking, but the basics are explained here: https://unix.stackexchange.com/q/400163/49405 Signed-off-by: Jack Mitchell <jack@embed.me.uk> Signed-off-by: Diego Rondini <diego.rondini@kynetics.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2019-09-15timezone:upgrade 2019b -> 2019cZang Ruochen
-tzdata : upgrade from 2019b to 2019c. -tzcode-native : upgrade from 2019b to 2019c. -tzdata.bb and tzcode-native.bb require timezone.inc. Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2019-09-15ghostscript: CVE-2019-14811, CVE-2019-14817Stefan Ghinea
A flaw was found in, ghostscript versions prior to 9.28, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands. A flaw was found in, ghostscript versions prior to 9.28, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands. References: https://nvd.nist.gov/vuln/detail/CVE-2019-14811 https://nvd.nist.gov/vuln/detail/CVE-2019-14817 Upstream patches: http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=885444fcbe10dc42787ecb76686c8ee4dd33bf33 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=cd1b1cacadac2479e291efe611979bdc1b3bdb19 Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2019-09-15screen: add /etc/screenrc as global config fileYi Zhao
Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2019-09-07diffutils: Added perl to support ptest & Skipped one test casePeiran Hong
Added perl to the run-time dependency of the recipe for diffutils since it is required by the test "large-subpot". The test "strip-trailing-cr" is skipped since it requires valgrind to work, but valgrind is considered too heavy-weight for diffutils package. Signed-off-by: Peiran Hong <peiran.hong@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-09-07iputils: Set prefix correctly for usrmergeAlex Kiernan
Fix build with usrmerge enabled: WARNING: iputils-s20190709-r0 do_package: iputils: alternative target (/usr/bin/ping or /usr/bin/ping.iputils) does not exist, skipping... WARNING: iputils-s20190709-r0 do_package: iputils: NOT adding alternative provide /usr/bin/ping: /usr/bin/ping.iputils does not exist ERROR: iputils-s20190709-r0 do_package: QA Issue: iputils: Files/directories were installed but not shipped in any package: /bin/tftpd /bin/tracepath /bin/arping /bin/clockdiff /bin/ping /bin/traceroute6 /sbin/rarpd /sbin/ninfod /sbin/rdisc Please set FILES such that these items are packaged. Alternatively if they are unneeded, avoid installing them or delete them within do_install. iputils: 9 installed and not shipped files. [installed-vs-shipped] WARNING: iputils-s20190709-r0 do_package: iputils: alt_link == alt_target: /usr/bin/ping == /usr/bin/ping Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-30 17:17:54 +0000