Commit Graph

36930 Commits

Author SHA1 Message Date
Scott Rifenbark
6ffa151404 documentation: Updates to support 2.0.3 release in Jethro
Made the following changes to support the 2.0.3 release:

 * Updated appropriate variables in the poky.ent file
 * Updated the Manual revision tables for November of 2016
 * Updated the mega-manual.sed file to create correct strings
   for the 2.0.3 release.

(From yocto-docs rev: 4492fb46e478f3e89898d7bcc992f63d59396bd5)

Signed-off-by: Scott Rifenbark <srifenbark@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-16 10:38:29 +00:00
Wenzong Fan
c1ba8e1174 gnupg: fix find-version for beta checking
find-version always assumes that gnupg is beta if autogen.sh is run
out of git-repo. This doesn't work for users whom just take release
tarball and re-run autoconf in their local build dir.

This fixes runtime issue:

  $gpg --list-sigs
  gpg: NOTE: THIS IS A DEVELOPMENT VERSION!
  gpg: It is only intended for test purposes and should NOT be
  gpg: used in a production environment or with production keys!

(From OE-Core rev: d39e7ca717b67ad9f2f78b83d90d91e410e52965)

Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-03 17:41:08 +00:00
Mingli Yu
c3f5e64b58 perl: fix CVE-2016-1238
Backport patch to fix CVE-2016-1238 from perl upstream:
http://perl5.git.perl.org/perl.git/commitdiff/cee96d52c39b1e7b36e1c62d38bcd8d86e9a41ab

(From OE-Core rev: 7d06ffcbcd0c71dc6dc9efde02bf0cd8d7c7d7e3)

(From OE-Core rev: 39ef8e22b52d3f5daa853aa7866145e9c5469d4b)

Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

Fixed up to apply to 5.20.0
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-06 08:51:17 +01:00
Mingli Yu
84997c7f21 perl: fix CVE-2015-8607
Backport patch to fix CVE-2015-8607 from perl upstream:
http://perl5.git.perl.org/perl.git/commitdiff/0b6f93036de171c12ba95d415e264d9cf7f4e1fd

(From OE-Core rev: e2289647ace9ef96e6a7e4aae201fd9149e56678)

(From OE-Core rev: d0451b2ed92867a0a2c37baded45cff997739153)

Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

fixed up to apply to 5.22.0
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-06 08:51:17 +01:00
Mingli Yu
e26f842287 perl: fix CVE-2016-6185
Backport patch to fix CVE-2016-6185 from perl upstream:
http://perl5.git.perl.org/perl.git/commitdiff/08e3451d7

(From OE-Core rev: 81e550d0c23c9842b85207cdfa73bbe9102e01fb)

(From OE-Core rev: 6c72a96e0492e71b6eb9ae72883f4087e75265f0)

Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

fixed up to apply against 5.22.0
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-06 08:51:17 +01:00
Kai Kang
2b8ab746ba perl: fix CVE-2016-2381
Backport patch to fix CVE-2016-2381 from perl upstream:

http://perl5.git.perl.org/perl.git/commitdiff/ae37b791a73a9e78dedb89fb2429d2628cf58076

(From OE-Core rev: 07ca8a0131f43e9cc2f720e1cdbcb7ba7c074886)

(From OE-Core rev: 30b33f5ad1d7a7c55620598427009bd27cfb3d42)

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

Fixed up to apply again 5.22.0
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-06 08:51:17 +01:00
Armin Kuster
b4362e0955 tzdata: update to 2016g
LICENSE md5sum changed do to rewording some text not released to the license.
see 8c143a2b65

  Changes to future time stamps

    Turkey switched from EET/EEST (+02/+03) to permanent +03,
    effective 2016-09-07.  (Thanks to Burak AYDIN.)  Use "+03" rather
    than an invented abbreviation for the new time.

    New leap second 2016-12-31 23:59:60 UTC as per IERS Bulletin C 52.
    (Thanks to Tim Parenti.)

  Changes to past time stamps

    For America/Los_Angeles, spring-forward transition times have been
    corrected from 02:00 to 02:01 in 1948, and from 02:00 to 01:00 in
    1950-1966.

    For zones using Soviet time on 1919-07-01, transitions to UT-based
    time were at 00:00 UT, not at 02:00 local time.  The affected
    zones are Europe/Kirov, Europe/Moscow, Europe/Samara, and
    Europe/Ulyanovsk.  (Thanks to Alexander Belopolsky.)

  Changes to past and future time zone abbreviations

    The Factory zone now uses the time zone abbreviation -00 instead
    of a long English-language string, as -00 is now the normal way to
    represent an undefined time zone.

    Several zones in Antarctica and the former Soviet Union, along
    with zones intended for ships at sea that cannot use POSIX TZ
    strings, now use numeric time zone abbreviations instead of
    invented or obsolete alphanumeric abbreviations.  The affected
    zones are Antarctica/Casey, Antarctica/Davis,
    Antarctica/DumontDUrville, Antarctica/Mawson, Antarctica/Rothera,
    Antarctica/Syowa, Antarctica/Troll, Antarctica/Vostok,
    Asia/Anadyr, Asia/Ashgabat, Asia/Baku, Asia/Bishkek, Asia/Chita,
    Asia/Dushanbe, Asia/Irkutsk, Asia/Kamchatka, Asia/Khandyga,
    Asia/Krasnoyarsk, Asia/Magadan, Asia/Omsk, Asia/Sakhalin,
    Asia/Samarkand, Asia/Srednekolymsk, Asia/Tashkent, Asia/Tbilisi,
    Asia/Ust-Nera, Asia/Vladivostok, Asia/Yakutsk, Asia/Yekaterinburg,
    Asia/Yerevan, Etc/GMT-14, Etc/GMT-13, Etc/GMT-12, Etc/GMT-11,
    Etc/GMT-10, Etc/GMT-9, Etc/GMT-8, Etc/GMT-7, Etc/GMT-6, Etc/GMT-5,
    Etc/GMT-4, Etc/GMT-3, Etc/GMT-2, Etc/GMT-1, Etc/GMT+1, Etc/GMT+2,
    Etc/GMT+3, Etc/GMT+4, Etc/GMT+5, Etc/GMT+6, Etc/GMT+7, Etc/GMT+8,
    Etc/GMT+9, Etc/GMT+10, Etc/GMT+11, Etc/GMT+12, Europe/Kaliningrad,
    Europe/Minsk, Europe/Samara, Europe/Volgograd, and
    Indian/Kerguelen.  For Europe/Moscow the invented abbreviation MSM
    was replaced by +05, whereas MSK and MSD were kept as they are not
    our invention and are widely used.

  Changes to zone names

    Rename Asia/Rangoon to Asia/Yangon, with a backward compatibility link.
    (Thanks to David Massoud.)

(From OE-Core rev: d1341aeda6d9fa5d7f13afabadae60a6fc295b87)

(From OE-Core rev: 4662af3256d6f373e2071047b8a845361188e878)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-06 08:51:17 +01:00
Armin Kuster
0ad02a1f1a tzcode-native: Update to 2016g
LICENSE file checksum changed do to a verbage change.

  Changes to code

    zic no longer generates binary files containing POSIX TZ-like
    strings that disagree with the local time type after the last
    explicit transition in the data.  This fixes a bug with
    Africa/Casablanca and Africa/El_Aaiun in some year-2037 time
    stamps on the reference platform.  (Thanks to Alexander Belopolsky
    for reporting the bug and suggesting a way forward.)

    If the installed localtime and/or posixrules files are symbolic
    links, zic now keeps them symbolic links when updating them, for
    compatibility with platforms like OpenSUSE where other programs
    configure these files as symlinks.

    zic now avoids hard linking to symbolic links, avoids some
    unnecessary mkdir and stat system calls, and uses shorter file
    names internally.

    zdump has a new -i option to generate transitions in a
    more-compact but still human-readable format.  This option is
    experimental, and the output format may change in future versions.
    (Thanks to Jon Skeet for suggesting that an option was needed,
    and thanks to Tim Parenti and Chris Rovick for further comments.)

  Changes to build procedure

    An experimental distribution format is available, in addition
    to the traditional format which will continue to be distributed.
    The new format is a tarball tzdb-VERSION.tar.lz with signature
    file tzdb-VERSION.tar.lz.asc.  It unpacks to a top-level directory
    tzdb-VERSION containing the code and data of the traditional
    two-tarball format, along with extra data that may be useful.
    (Thanks to Antonio Diaz Diaz, Oscar van Vlijmen, and many others
    for comments about the experimental format.)

    The release version number is now more accurate in the usual case
    where releases are built from a Git repository.  For example, if
    23 commits and some working-file changes have been made since
    release 2016g, the version number is now something like
    '2016g-23-g50556e3-dirty' instead of the misleading '2016g'.
    Official releases uses the same version number format as before,
    e.g., '2016g'.  To support the more-accurate version number, its
    specification has moved from a line in the Makefile to a new
    source file 'version'.

    The experimental distribution contains a file to2050.tzs that
    contains what should be the output of 'zdump -i -c 2050' on
    primary zones.  If this file is available, 'make check' now checks
    that zdump generates this output.

    'make check_web' now works on Fedora-like distributions.

  Changes to documentation and commentary

    tzfile.5 now documents the new restriction on POSIX TZ-like
    strings that is now implemented by zic.

    Comments now cite URLs for some 1917-1921 Russian DST decrees.
    (Thanks to Alexander Belopolsky.)

    tz-link.htm mentions JuliaTime (thanks to Curtis Vogt) and Time4J
    (thanks to Meno Hochschild) and ThreeTen-Extra, and its
    description of Java 8 has been brought up to date (thanks to
    Stephen Colebourne).  Its description of local time on Mars has
    been updated to match current practice, and URLs have been updated
    and some obsolete ones removed.

(From OE-Core rev: 19c365b23c3b835dcb5595aba598f35bf16a6d81)

(From OE-Core rev: f5213870101ab57eb6303290c57935aed40cd9c4)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-06 08:51:17 +01:00
Armin Kuster
6ec3aa9972 tzcode-native: update to 2016f
changes done in data

(From OE-Core rev: 29377fa91a5f679909d582317c2b53d1f2e5da88)

(From OE-Core rev: 319df4f24b3eca45f068514826e08ab0aeed4f93)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-06 08:51:17 +01:00
Armin Kuster
ac81181091 tzdata: update to 2016f
Changes affecting future time stamps

    The Egyptian government changed its mind on short notice, and
    Africa/Cairo will not introduce DST starting 2016-07-07 after all.
    (Thanks to Mina Samuel.)

    Asia/Novosibirsk switches from +06 to +07 on 2016-07-24 at 02:00.
    (Thanks to Stepan Golosunov.)

  Changes to past and future time stamps

    Asia/Novokuznetsk and Asia/Novosibirsk now use numeric time zone
    abbreviations instead of invented ones.

  Changes affecting past time stamps

    Europe/Minsk's 1992-03-29 spring-forward transition was at 02:00 not 00:00.
    (Thanks to Stepan Golosunov.)

(From OE-Core rev: dc80bf9b092a76f758d01474619cd9db46a1070d)

(From OE-Core rev: c1191c22fe9d92262645da17f741014a4465a0eb)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-06 08:51:17 +01:00
Armin Kuster
90dc28b0b6 openssl: Security fix CVE-2016-6306
affects openssl < 1.0.1i

(From OE-Core rev: 7277061de39cdcdc2d1db15cefd9040a54527cd6)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-06 08:51:17 +01:00
Armin Kuster
8df8e70f96 openssl: Security fix CVE-2016-6304
affects openssl < 1.0.1i

(From OE-Core rev: d6e1a56f4e764832ac84b842fa2696b56d850ee9)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-06 08:51:17 +01:00
Armin Kuster
d23b450ea3 openssl: Security fix CVE-2016-6303
affects openssl < 1.0.1i

(From OE-Core rev: df7e4fdba42e9fcb799e812f6706bd56967858d9)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-06 08:51:17 +01:00
Armin Kuster
91353b6936 openssl: Security fix CVE-2016-6302
affects openssl < 1.0.1i

(From OE-Core rev: 963c69e1e8e9cefccccb59619cb07ee31f07ffa1)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-06 08:51:17 +01:00
Armin Kuster
942832888b openssl: Security fix CVE-2016-2182
affects openssl < 1.0.1i

(From OE-Core rev: bf3918d613b6b2a9707af1eb3c253d23f84d09a3)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-06 08:51:17 +01:00
Armin Kuster
dc61ec5f0c openssl: Security fix CVE-2016-2181
affects openssl < 1.0.1i

(From OE-Core rev: c3d4cc8e452b29d4ca620b5c93d22a88c5aa1f03)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-06 08:51:17 +01:00
Armin Kuster
766c5ced75 openssl: Security fix CVE-2016-2180
affects openssl < 1.0.1i

(From OE-Core rev: ed8bed3bf2d2460ff93bdaa255091e0d388a8209)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-06 08:51:17 +01:00
Robert Yang
2ff9d30dac init-install.sh: fix disk_size
It mis-matched "SanDisk" or "Disk Flags" before, which caused unexpected
error.

(From OE-Core rev: 346b6ef31253789d7d6664a19297b6deec9d27a0)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a68ac76c1b6ed4c1a2fbc944c5021c89fd26217f)
[YOCTO #10333]
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-27 22:23:00 +01:00
Armin Kuster
2804850ea7 util-linux: Security fix for CVE-2016-5011
affects util-linux < 2.28.2

(From OE-Core rev: c9c85df86cd2270b144fa824ef76adedd3636c8a)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:04 +01:00
Armin Kuster
6998a3c1e6 qemu: Secuirty fix for CVE-2016-5403
affects qemu < 2.7.0-rc0

(From OE-Core rev: 2f3f09dfbff21fb74e50e4e3ce90c252d32ebf61)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:04 +01:00
Armin Kuster
6057d0aa47 qemu: Security fix for CVE-2016-4002
affects qemu < 2.6.0

(From OE-Core rev: 6d7c10eae8b23a71eee6d59baab42d98d8fb7ff8)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:04 +01:00
Armin Kuster
48048dcaa2 qemu: Security fix CVE-2016-6351
affects qemu < 2.6.0

(From OE-Core rev: 5729eb105ff69cae0eac7a596cb0e938f6159526)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:04 +01:00
Armin Kuster
931a6e6d5e qemu: Security fix CVE-2016-4439
affects qemu < 2.6.0

(From OE-Core rev: 628b9bfc91a6f73a5dfff7ade1819ea6a2db7cf0)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:04 +01:00
Armin Kuster
98e7d8a9a0 qemu: Security Fix CVE-2016-3712
affects qemu < 2.6.0

(From OE-Core rev: 6f25d966c41df5315d253859d9ebf231963bf671)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:04 +01:00
Armin Kuster
ffa3a07ac1 qemu: Security Fix CVE-2016-3710
affects Qemu < 2.6.0

(From OE-Core rev: 8ce0ce8a229f8cb2b854e3b9619a9ad75d9b6fe4)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:04 +01:00
Armin Kuster
661aff850e wget: Security fix CVE-2016-4971
affects wget < 1.18.0

(From OE-Core rev: 15b6586ae64f745777ba5c42f4cf055aeeed83d8)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:03 +01:00
Armin Kuster
8f62c3dc44 openssh: Security fix CVE-2015-8325
openssh <  7.2p2

(From OE-Core rev: c71cbdd557476b7669c28b44f56e21ce0d0c53dc)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:03 +01:00
Armin Kuster
2622059ca0 openssh: Security fix CVE-2016-5615
openssh < 7.3

(From OE-Core rev: 3fdad451afcc16b1fa94024310b4d26333ca7de9)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:03 +01:00
Armin Kuster
ddb1db9ef7 openssh: Security fix CVE-2016-6210
affects openssh < 7.3

(From OE-Core rev: 7d07de3841c0a736262088c95a938deff194d9e2)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:03 +01:00
Armin Kuster
fc1ba0b67f git: Security fix CVE-2016-2315 CVE-2016-2324
git versions < 2.5.5 & 2.7.4

(From OE-Core rev: 64ff6226d0c927c05fc42fd9ca8b31bac129b16d)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:03 +01:00
Armin Kuster
9657825ef3 bind: Security fix CVE-2016-2088
(From OE-Core rev: 91e05c25eb221ff1dc2bde5cfaa0bea88345b1e4)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:03 +01:00
Yi Zhao
9f1dc20619 tiff: Security fix CVE-2016-5323
CVE-2016-5323 libtiff: a maliciously crafted TIFF file could cause the
application to crash when using tiffcrop command

External References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5323
http://bugzilla.maptools.org/show_bug.cgi?id=2559

Patch from:
2f79856097

(From OE-Core rev: 4e2f4484d6e1418c34f65de954809d06df41cc38)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 4ad1220e0a7f9ca9096860f4f9ae7017b36e29e4)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:03 +01:00
Yi Zhao
c95d42a7d1 tiff: Security fix CVE-2016-5321
CVE-2016-5321 libtiff: a maliciously crafted TIFF file could cause the
application to crash when using tiffcrop command

External References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5321
http://bugzilla.maptools.org/show_bug.cgi?id=2558

Patch from:
d9783e4a14

(From OE-Core rev: 35a7cb62be554e28f64b7583d46d693ea184491f)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 4a167cfb6ad79bbe2a2ff7f7b43c4a162ca42a4d)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:03 +01:00
Yi Zhao
7d403a2ecd tiff: Security fix CVE-2016-3186
CVE-2016-3186 libtiff: buffer overflow in the readextension function in
gif2tiff.c allows remote attackers to cause a denial of service via a
crafted GIF file

External References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3186
https://bugzilla.redhat.com/show_bug.cgi?id=1319503

Patch from:
https://bugzilla.redhat.com/attachment.cgi?id=1144235&action=diff

(From OE-Core rev: b4471e7264538b3577808fae5e78f42c0d31e195)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 3d818fc862b1d85252443fefa2222262542a10ae)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:03 +01:00
Ismo Puustinen
75e6b3b57b libpcre: Fix CVE-2016-3191
Fix workspace overflow for (*ACCEPT) with deeply nested parentheses.

The patch is from libpcre version control at
http://vcs.pcre.org/pcre?view=revision&revision=1631 with the ChangeLog
part removed. Original author is Philip Hazel.

(From OE-Core rev: 249cc163e7a16f307e8b94a7b449cd3e93cc6b15)

Signed-off-by: Ismo Puustinen <ismo.puustinen@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 386534f968f4da376ba7778b5d436bad4ce8355b)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:03 +01:00
Armin Kuster
cb5dd8d314 openssl: Security fix CVE-2016-2178
affects  openssl <=  1.0.2h
CVSS v2 Base Score: 2.1 LOW

(From OE-Core rev: 82fe0e8c98244794531f0e24ceb93953fe68dda5)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 5b3df0c5e8885ea34f66b41fcf209a9960fbbf5e)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:03 +01:00
Armin Kuster
1fedf13e63 openssl: Security fix CVE-2016-2177
Affects openssl <= 1.0.2h
CVSS v2 Base Score: 7.5 HIGH

(From OE-Core rev: 5781eb9a6e6bf8984b090a488d2a326bf9fafcf8)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 2848c7d3e454cbc84cba9183f23ccdf3e9200ec9)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:03 +01:00
Ross Burton
e1b940b4d1 openssl: add a patch to fix parallel builds
Apply a patch taken from Gentoo to hopefully fix the remaining parallel make
races.

(From OE-Core rev: 7ab2f49107cf491d602880205a3ea1222cb5e616)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 3d806d59a4c5e8ff35c7e7c5a3a6ef85e2b4b259)

Minor fixup to get patch to apply to jethro
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:03 +01:00
Ross Burton
b2e2a7426c bitbake: fetch2/wget: fallback to GET if HEAD is rejected in checkstatus()
The core change here is to fall back to GET requests if HEAD is rejected in the
checkstatus() method, as you can't do a HEAD on Amazon S3 (used by Github
archives).  This meant removing the monkey patch that the default method was GET
and adding a fixed redirect handler that doesn't reset to GET.

Also, change the way the opener is constructed from an if/elif cluster to a
conditionally constructed list.

(Bitbake rev: b993d96203541cd2919d688559ab802078a7a506)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 6ec70d5d2e330b41b932b0a655b838a5f37df01e)
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:19:42 +01:00
Ross Burton
524417d587 bitbake: lib/bb/tests/fetch: remove URL that doesn't exist anymore
The CUPS ipptool URL we were checking now redirects to github where the tarball
isn't present, so remove it from the test suite.

(Bitbake rev: ed890c3b54a98ff269cea4e35d246f3b3c0b6ba9)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 4b50895fb3462b21e3874a2e99c363c8d05e89e6)
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:19:42 +01:00
Richard Purdie
0a9e04cade bitbake: bb/tests/fetch: Update cups url
Update the upstream url used for testing cups versions after upstream website
changes.

minor fixup to apply

(Bitbake rev: 79810903cf4141b8c1538975ed89cac553628edd)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

[Bitbake upstream: 5f06041d4936fc22297945bbbad7020bfa9083c6 ]
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:19:42 +01:00
Maxin B. John
37eb21b2b1 curl: security fix for CVE-2016-5421
Affected versions: libcurl 7.32.0 to and including 7.50.0

(From OE-Core rev: f6999fa952c7db980cfc97f6e5a971e4f34cc0a3)

Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-02 08:48:35 +01:00
Maxin B. John
72ea3c272c curl: security fix for CVE-2016-5420
Affected versions: libcurl 7.1 to and including 7.50.0

(From OE-Core rev: 6b732a392289a7bb50b0e3716c066c62fa32a14d)

Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-02 08:48:35 +01:00
Maxin B. John
0e0c04343d curl: security fix for CVE-2016-5419
Affected versions: libcurl 7.1 to and including 7.50.0

(From OE-Core rev: d1d6c93b491056b18b528216303047e353956e34)

Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-02 08:48:34 +01:00
Enrico Jorns
4037644690 perl-ptest.inc: fix tar call to prevent objcopy failure
With tar version 1.29, the tar call used to copy the ptest files will
not work anymore. While the call did not match the man page (but worked)
before, anyway, the latest update of tar seems to have a more strict argument
handling.

With the current version of the tar call, the copying of files still
works with latest tar version, but the excludes will not be handled
properly anymore.
This results in having binaries compiled with host GCC in the package.
When doing the strip_and_split files in do_package() with the target
objcopy, bitbake will fail with this error:

  ERROR: objcopy failed with exit code 256 (cmd was [...])
  [...]
  File format not recognized

Thus, the current argument issues and required changes are:

 * Options must be placed _before_ the pathnames.

 * --exclude must be followd by a '=' in order to work properly

 * 'f' options is for providing an archive file, which is unnecessary in
   this case

Note that this could also be a candidate for backporting.

(From OE-Core master rev: 2e498879098f7d84610aed7961d92433083d9a02)

(From OE-Core rev: a27b907dd3ad20fc60b7732c19012793aaaba2df)

Signed-off-by: Enrico Jorns <ejo@pengutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 09:00:53 +01:00
Anuj Mittal
64b9c83b0c gcc: make sure header path is set correctly
We're setting the native header paths in do_configure_prepend,
and don't need to set them again here.

This results in gcc-target not being able to locate the headers
and not being able to detect glibc version, which in turn
results in SSP support not getting detected even though it's available
in libc.

(From OE-Core master rev: 85630aa894278e7818c867179dc19ca2fbd994fc)

(From OE-Core rev: f28840de3912c805acde8d11188f0c48617678ab)

Signed-off-by: Anuj Mittal <anujx.mittal@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 09:00:53 +01:00
Armin Kuster
96456b15ea tzdata: update to 2016e
Changes affecting future time stamps

Africa/Cairo observes DST in 2016 from July 7 to the end of October.
Guess October 27 and 24:00 transitions. (Thanks to Steffen Thorsen.)
For future years, guess April's last Thursday to October's last
Thursday except for Ramadan.

Changes affecting past time stamps

Locations while uninhabited now use '-00', not 'zzz', as a
placeholder time zone abbreviation.  This is inspired by Internet
RFC 3339 and is more consistent with numeric time zone
abbreviations already used elsewhere.  The change affects several
arctic and antarctic locations, e.g., America/Cambridge_Bay before
1920 and Antarctica/Troll before 2005.

Asia/Baku's 1992-09-27 transition from +04 (DST) to +04 (non-DST) was
at 03:00, not 23:00 the previous day.  (Thanks to Michael Deckers.)

(From OE-Core master rev: ddcf128e76ed0678ce42416531f4ecb309c57439)

(From OE-Core rev: 225f3b4ea4c7c7439bba2b3a85f24ea94d2f47bc)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 09:00:53 +01:00
Armin Kuster
d8b15a0384 tzcode: update to 2016e
V2: typo in title (jet lagged)
Changes to code

zic now outputs a dummy transition at time 2**31 - 1 in zones
whose POSIX-style TZ strings contain a '<'.  This mostly works
around Qt bug 53071 <https://bugreports.qt.io/browse/QTBUG-53071>.
(Thanks to Zhanibek Adilbekov for reporting the Qt bug.)

Changes affecting documentation and commentary

tz-link.htm says why governments should give plenty of notice for
time zone or DST changes, and refers to Matt Johnson's blog post.
tz-link.htm mentions Tzdata for Elixir.  (Thanks to Matt Johnson.)

(From OE-Core master rev: 5f3340e5c966f4233e0cd4ec468b20a1fd5a7346)

(From OE-Core rev: 6d9e6b6fb2c8c6c80a5981b0f91987b433b6ea24)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 09:00:53 +01:00
George McCollister
9149baa38d wic: fix path parsing, use last occurrence
If the path contains 'scripts' more than once the first occurrence will be
incorrectly used. Use rfind instead of find to find the last occurrence.

(From OE-Core rev: fd544c3ef6ece1e2f9849ee87227efc6d0954e15)

Signed-off-by: George McCollister <george.mccollister@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 09:00:53 +01:00
Nicolas Dechesne
a01d3234f6 bluez5: move btmgmt to common READLINE section
Upstream in 5.33 btmgmt was moved from experimental to common READLINE section,
in commit e4f0c5582f1fe3451d5588243adba9de1ed68b80, but this was never updated
in the recipe.

This is a backport from master branch, commit
28777e593d3dd3a5d0ee2effcdca6a971e2887f9.

(From OE-Core rev: cbe0648e234e83b8ffc336118d3ee2967b4bb175)

Signed-off-by: Nicolas Dechesne <nicolas.dechesne@linaro.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 09:00:53 +01:00