aboutsummaryrefslogtreecommitdiffstats
path: root/meta
AgeCommit message (Collapse)Author
2016-02-03piglit: don't use /tmp to write generated sources tosgw/jethroRoss Burton
If there are multiple builds on the same machine then piglit writing it's generated sources to /tmp will race. Instead, export TEMP to tell the tempfile module to use a temporary directory under ${B}. Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Saul Wold <sgw@linux.intel.com>
2016-02-02linux-yocto: Update SRCREV for qemux86* for 4.1, fixes CVE-2016-0728Alejandro Hernandez
This addresses CVE-2016-0728: KEYS: Fix keyring ref leak in join_session_keyring(), and upgrades to LINUX_VERSION 4.1.17 Signed-off-by: Alejandro Hernandez <alejandro.hernandez@linux.intel.com> Signed-off-by: Saul Wold <sgw@linux.intel.com>
2016-02-02linux-yocto: Update SRCREV for qemux86* for 3.19, fixes CVE-2016-0728Alejandro Hernandez
This addresses CVE-2016-0728: KEYS: Fix keyring ref leak in join_session_keyring() Signed-off-by: Alejandro Hernandez <alejandro.hernandez@linux.intel.com> Signed-off-by: Saul Wold <sgw@linux.intel.com>
2016-02-02linux-yocto: Update SRCREV for qemux86* for 3.14, fixes CVE-2016-0728Alejandro Hernandez
This addresses CVE-2016-0728: KEYS: Fix keyring ref leak in join_session_keyring(), and upgrades to LINUX_VERSION 3.14.39 Signed-off-by: Alejandro Hernandez <alejandro.hernandez@linux.intel.com> Signed-off-by: Saul Wold <sgw@linux.intel.com>
2016-02-02libpng12: update URL that no longer existsMaxin B. John
Fix the following warning: WARNING: Failed to fetch URL http://downloads.sourceforge.net/project/ libpng/libpng12/1.2.53/libpng-1.2.53.tar.xz, attempting MIRRORS if available. [YOCTO #8739] Signed-off-by: Maxin B. John <maxin.john@intel.com> Signed-off-by: Saul Wold <sgw@linux.intel.com>
2016-02-02libpng: update URL that no longer existsMaxin B. John
Fix the following warning: WARNING: Failed to fetch URL http://downloads.sourceforge.net/ project/libpng/libpng16/1.6.17/libpng-1.6.17.tar.xz, attempting MIRRORS if available [YOCTO #8739] Signed-off-by: Maxin B. John <maxin.john@intel.com> Signed-off-by: Saul Wold <sgw@linux.intel.com>
2016-02-02busybox: fix build of last appletRoss Burton
If CONFIG_FEATURE_LAST_SMALL is enabled the build fails because of a broken __UT_NAMESIZE test. [ YOCTO #8869 ] Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Saul Wold <sgw@linux.intel.com>
2016-02-02ghostscript: add dependency for pnglibconf.hJoe Slater
When using parallel make jobs, we need to be sure that pnglibconf.h is created before we try to reference it, so add a rule to png.mak. Signed-off-by: Joe Slater <jslater@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit fad19750d23aad2d14a1726c4e3c2c0d05f6e13d) Signed-off-by: Saul Wold <sgw@linux.intel.com>
2016-02-02gcr: Require x11 DISTRO_FEATUREJussi Kukkonen
This enables a world build without x11. GTK3DISTROFEATURES is not enough because gtk+-x11.pc is still required. Fixes [YOCTO #8611]. Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit dbdcd87144cc1cd6c5d50c800c7f266aaf25ca17) Signed-off-by: Saul Wold <sgw@linux.intel.com>
2016-02-02uClibc: enable utmp for shadow compatibilityBogdan-Alexandru Voiculescu
with the enabling of utmpx in busybox and uClibc it was noted that shadow support for utmpx also needs utmp explicitly enabled in uclibc. this is a workaround that might be removed once shadow properly supports --enable-utmpx to check for utmpx configuration instead of utmp like it does now [YOCTO #8243] [YOCTO #8971] Signed-off-by: Bogdan-Alexandru Voiculescu <bogdanx.a.voiculescu@intel.com> Signed-off-by: Benjamin Esquivel <benjamin.esquivel@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 969158d63ba2c8e2e11af41c2a6d4f1aa5b0099f) Signed-off-by: Saul Wold <sgw@linux.intel.com>
2016-02-01git: Security fix CVE-2015-7545Armin Kuster
CVE-2015-7545 git: arbitrary code execution via crafted URLs Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-02-01glibc-locale: fix QA warningArmin Kuster
WARNING: QA Issue: glibc-locale: /glibc-binary-localedata-sd-in/usr/lib/locale/sd_IN/LC_CTYPE is owned by uid 1000, which is the same as the user running bitbake. This may be due to host contamination [host-user-contaminated] fix type Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-02-01grub: Security fix CVE-2015-8370Armin Kuster
CVE-2015-8370 grub2: buffer overflow when checking password entered during bootup Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-02-01gdk-pixbuf: Security fix CVE-2015-7674Armin Kuster
CVE-2015-7674 Heap overflow with a gif file in gdk-pixbuf < 2.32.1 Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-02-01librsvg: Security fix CVE-2015-7558Armin Kuster
CVE-2015-7558 librsvg2: Stack exhaustion causing DoS including two supporting patches. Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-02-01bind: Security fix CVE-2015-8461Armin Kuster
CVE-2015-8461 bind: race condition when handling socket errors can lead to an assertion failure in resolver.c\ Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-02-01bind: Security fix CVE-2015-8000Armin Kuster
CVE-2015-8000 bind: responses with a malformed class attribute can trigger an assertion failure in db.c Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-02-01libxml2: Security fix CVE-2015-8710Armin Kuster
CVE-2015-8710 libxml2: out-of-bounds memory access when parsing an unclosed HTML comment Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-02-01libxml2: Security fix CVE-2015-8241Armin Kuster
CVE-2015-8241 libxml2: Buffer overread with XML parser in xmlNextChar Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-02-01dpkg: Security fix CVE-2015-0860Armin Kuster
CVE-2015-0860 dpkg: stack overflows and out of bounds read Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-02-01tzdata: update to 2016aArmin Kuster
Changed LIC_CHKSUM_FILES to a new LICENSE file. Add BSD-3-clause to licenses Changes affecting future time stamps America/Cayman will not observe daylight saving this year after all. Revert our guess that it would. (Thanks to Matt Johnson.) Asia/Chita switches from +0800 to +0900 on 2016-03-27 at 02:00. (Thanks to Alexander Krivenyshev.) Asia/Tehran now has DST predictions for the year 2038 and later, to be March 21 00:00 to September 21 00:00. This is likely better than predicting no DST, albeit off by a day every now and then. Changes affecting past and future time stamps America/Metlakatla switched from PST all year to AKST/AKDT on 2015-11-01 at 02:00. (Thanks to Steffen Thorsen.) America/Santa_Isabel has been removed, and replaced with a backward compatibility link to America/Tijuana. Its contents were apparently based on a misreading of Mexican legislation. Changes affecting past time stamps Asia/Karachi's two transition times in 2002 were off by a minute. (Thanks to Matt Johnson.) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 39e231cfabda8d75906c935d2a01f37df6121b84) Signed-off-by: Saul Wold <sgw@linux.intel.com>
2016-02-01tzcode: update to 2016aArmin Kuster
Change LIC_CHKSUM_FILES to License. Some files are BSD clause 3 Changes affecting build procedure An installer can now combine leap seconds with use of the backzone file, e.g., with 'make PACKRATDATA=backzone REDO=posix_right zones'. The old 'make posix_packrat' rule is now marked as obsolescent. (Thanks to Ian Abbott for an initial implementation.) Changes affecting documentation and commentary A new file LICENSE makes it easier to see that the code and data are mostly public-domain. (Thanks to James Knight.) The three non-public-domain files now use the current (3-clause) BSD license instead of older versions of that license. tz-link.htm mentions the BDE library (thanks to Andrew Paprocki), CCTZ (thanks to Tim Parenti), TimeJones.com, and has a new section on editing tz source files (with a mention of Sublime zoneinfo, thanks to Gilmore Davidson). The Theory and asia files now mention the 2015 book "The Global Transformation of Time, 1870-1950", and cite a couple of reviews. The America/Chicago entry now documents the informal use of US central time in Fort Pierre, South Dakota. (Thanks to Rick McDermid, Matt Johnson, and Steve Jones.) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit b7f292b84eea202fb13730c11452ac1957e41cf0) Signed-off-by: Saul Wold <sgw@linux.intel.com>
2016-02-01kernel-yocto: fix checkout bare-cloned kernel repositoriesJianxun Zhang
The existing code doesn't tell regular (with .git) and bare cases and just move the unpacked repo to the place of kernel source. But later steps will fail on a bare-cloned repo because we can not checkout directly in a bare cloned repo. This change performs another clone to fix the issue. Note: This change doesn't cover the case that S and WORKDIR are same and the repo is bare cloned. Signed-off-by: Jianxun Zhang <jianxun.zhang@linux.intel.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit ccfa2ee5c4f509de4c18a7054b2a66fc874d5d69) Signed-off-by: Saul Wold <sgw@linux.intel.com>
2016-01-30libpcre: bug fixes include securityArmin Kuster
[Yocto # 9008] This is the next patch release for pcre. The 8.xx series now only contains bug fixes. http://www.pcre.org/original/changelog.txt The following security fixes are included: CVE-2015-3210 pcre: heap buffer overflow in pcre_compile2() / compile_regex() CVE-2015-3217 pcre: stack overflow in match() CVE-2015-5073 CVE-2015-8388 pcre: Buffer overflow caused by certain patterns with an unmatched closing parenthesis CVE-2015-8380 pcre: Heap-based buffer overflow in pcre_exec CVE-2015-8381 pcre: Heap Overflow in compile_regex() CVE-2015-8383 pcre: Buffer overflow caused by repeated conditional group CVE-2015-8384 pcre: Buffer overflow caused by recursive back reference by name within certain group CVE-2015-8385 pcre: Buffer overflow caused by forward reference by name to certain group CVE-2015-8386 pcre: Buffer overflow caused by lookbehind assertion CVE-2015-8387 pcre: Integer overflow in subroutine calls CVE-2015-8389 pcre: Infinite recursion in JIT compiler when processing certain patterns CVE-2015-8390 pcre: Reading from uninitialized memory when processing certain patterns CVE-2015-8392 pcre: Buffer overflow caused by certain patterns with duplicated named groups CVE-2015-8393 pcre: Information leak when running pcgrep -q on crafted binary CVE-2015-8394 pcre: Integer overflow caused by missing check for certain conditions CVE-2015-8395 pcre: Buffer overflow caused by certain references CVE-2016-1283 pcre: Heap buffer overflow in pcre_compile2 causes DoS Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-01-30qemu: Security fix CVE-2015-7295Armin Kuster
CVE-2015-7295 Qemu: net: virtio-net possible remote DoS Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-01-30qemu: Security fix CVE-2016-1568Armin Kuster
CVE-2016-1568 Qemu: ide: ahci use-after-free vulnerability in aio port commands Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-01-30qemu: Security fix CVE-2015-8345Armin Kuster
CVE-2015-8345 Qemu: net: eepro100: infinite loop in processing command block list Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-01-30qemu: Security fix CVE-2015-7512Armin Kuster
CVE-2015-7512 Qemu: net: pcnet: buffer overflow in non-loopback mod Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-01-30qemu: Security fix CVE-2015-7504Armin Kuster
CVE-2015-7504 Qemu: net: pcnet: heap overflow vulnerability in loopback mode Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-01-30qemu: Security fix CVE-2015-8504Armin Kuster
CVE-2015-8504 Qemu: ui: vnc: avoid floating point exception Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-01-30openssl: Security fix CVE-2016-0701Armin Kuster
CVE-2016-0701 OpenSSL: DH small subgroups Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-01-30openssl: Security fix CVE-2015-3197Armin Kuster
CVE-2015-3197 OpenSSL: SSLv2 doesn't block disabled ciphers Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-01-30tiff: Security fix CVE-2015-8784Armin Kuster
CVE-2015-8784 libtiff: out-of-bound write in NeXTDecode() Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-01-30tiff: Security fix CVE-2015-8781Armin Kuster
CVE-2015-8781 libtiff: out-of-bounds writes for invalid images Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-01-30bind: CVE-2015-8704 and CVE-2015-8705Derek Straka
CVE-2015-8704: Allows remote authenticated users to cause a denial of service via a malformed Address Prefix List record CVE-2015-8705: When debug logging is enabled, allows remote attackers to cause a denial of service or have possibly unspecified impact via OPT data or ECS option [YOCTO 8966] References: https://kb.isc.org/article/AA-01346/0/BIND-9.10.3-P3-Release-Notes.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8704 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8705 Signed-off-by: Derek Straka <derek@asterius.io> Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
2016-01-30rpmresolve.c: Fix unfreed pointers that keep DB openedMariano Lopez
There are some unfreed rpmmi pointers in printDepList() function; this happens when the package have null as the requirement. This patch fixes these unfreed pointers and add small changes to keep consistency with some variables. [YOCTO #8028] (From OE-Core master rev: da7aa183f94adc1d0fff5bb81e827c584f9938ec) Signed-off-by: Mariano Lopez <mariano.lopez@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
2016-01-30openssh: CVE-2016-1907Armin Kuster
This issue requires three commits: https://anongit.mindrot.org/openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c https://anongit.mindrot.org/openssh.git/commit/?id=f98a09cacff7baad8748c9aa217afd155a4d493f https://anongit.mindrot.org/openssh.git/commit/?id=2fecfd486bdba9f51b3a789277bb0733ca36e1c0 (From OE-Core master rev: a42229df424552955c0ac62da1063461f97f5938) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
2016-01-30glibc: CVE-2015-8776Armin Kuster
it was found that out-of-range time values passed to the strftime function may cause it to crash, leading to a denial of service, or potentially disclosure information. Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
2016-01-30glibc: CVE-2015-9761Armin Kuster
A stack overflow vulnerability was found in nan* functions that could cause applications which process long strings with the nan function to crash or, potentially, execute arbitrary code. Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
2016-01-30glibc: CVE-2015-8779Armin Kuster
A stack overflow vulnerability in the catopen function was found, causing applications which pass long strings to the catopen function to crash or, potentially execute arbitrary code. Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
2016-01-30glibc: CVE-2015-8777.patchArmin Kuster
The process_envvars function in elf/rtld.c in the GNU C Library (aka glibc or libc6) before 2.23 allows local users to bypass a pointer-guarding protection mechanism via a zero value of the LD_POINTER_GUARD environment variable. Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
2016-01-21nativesdk-buildtools-perl-dummy: Bump PRRichard Purdie
Recent changes to this recipe caused automated PR increments to break, regressing package feeds. The only way to recover is to bump PR, so do this centrally to fix anyone affected. (From OE-Core rev: dacdb499d31cb2e80cca33cba9d599c8ee983dc4) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-01-21nativesdk-buildtools-perl-dummy: properly set PACKAGE_ARCHPaul Eggleton
Turns out I did a silly thing in OE-Core revision 9b1831cf4a2940dca1d23f14dff460ff5a50a520 and forgot to remove the explicit setting of PACKAGE_ARCH outside of the anonymous python function; the original bug was apparently fixed but the functionality of allarch.bbclass was being disabled because it was able to see that PACKAGE_ARCH was not set to "all" - which was what I was trying to ensure. (From OE-Core rev: a25ab5449825315d4f51b31a634fe6cd8f908526) Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-01-21nativesdk-buildtools-perl-dummy: fix rebuilding when SDKMACHINE changesPaul Eggleton
This recipe produces an empty dummy package (in order to satisfy dependencies on perl so we don't have perl within buildtools-tarball). Because we were inheriting nativesdk here the recipe was being rebuilt, but having forced PACKAGE_ARCH to a particular value the packages for each architecture were stepping on eachother. Since the packages are empty they can in fact be allarch (even though they won't actually go into the "all" package feed). It turns out that nheriting nativesdk wasn't actually necessary either, so drop that. Fixes [YOCTO #8509]. (From OE-Core rev: 9b1831cf4a2940dca1d23f14dff460ff5a50a520) Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-01-20Revert "gstreamer1.0-plugins-good.inc: add gudev back to PACKAGECONFIG"Richard Purdie
This reverts commit 5c90b561930aac1783485d91579d313932273e92. The original change was intentional so back out 'fixes'.
2016-01-20Revert "gstreamer: Deal with merge conflict which breaks systemd builds"Richard Purdie
This reverts commit bc458ae9586b45b11b6908eadb31e94d892e698f. The original change was intentional so back out 'fixes'.
2016-01-17build-appliance-image: Update to jethro head revisionRichard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-01-17gstreamer: Deal with merge conflict which breaks systemd buildsRichard Purdie
In jethro, the dependency is "udev", the change to libgudev happened in master after the release and this was a mistake during backporting of gstreamer fixes. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-01-15build-appliance-image: Update to jethro head revisionRichard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-01-15kernel/kernel-arch: Explicitly mapping between i386/x86_64 and x86 for ↵Jianxun Zhang
kernel ARCH For a bare-bone kernel recipe which specifies 32 bit x86 target, a 64 bit .config will be generated from do_configure task when building 32-bit qemux86, once all of these conditions are true: * arch of host is x86_64 * kernel source tree used in build has commit ffee0de41 which actually chooses i386 or x86_64 defconfig by asking host when ARCH is "x86" (arch/x86/Makefile) * bare-bone kernel recipe inherits directly from kernel without other special treatments. Build will fail because of the mismatched kernel architecture. The patch sets ARCH i386 or x86_64 explicitly to configure task to avoid this host contamination. Kernel artifact is also changed so that it can map i386 and x64 back to arch/x86 when needed. Signed-off-by: Jianxun Zhang <jianxun.zhang@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-24 20:46:58 +0000